diff --git a/Cargo.lock b/Cargo.lock
index 3d559d9011..ffbdcfcf0e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2391,7 +2391,6 @@ version = "0.0.0-dev.0"
 dependencies = [
  "cc",
  "tectonic_bridge_graphite2",
- "tectonic_bridge_icu",
  "tectonic_dep_support",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 03671766e8..b6aaed42bc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -138,28 +138,31 @@ overlay-triplets-path = "dist/vcpkg-triplets"
 # add them to crates/dep_support/src/lib.rs:new_from_vcpkg() to give users
 # guidance if they might need to set $VCPKGRS_TRIPLET.
 [package.metadata.vcpkg.target]
-x86_64-apple-darwin = { install = ["freetype", "harfbuzz[icu,graphite2]"] }
+x86_64-apple-darwin = { install = ["freetype", "harfbuzz[graphite2]", "icu"] }
 aarch64-apple-darwin = { triplet = "arm64-osx", install = [
   "freetype",
-  "harfbuzz[icu,graphite2]",
+  "harfbuzz[graphite2]",
+  "icu",
 ] }
 x86_64-unknown-linux-gnu = { install = [
   "fontconfig",
   "freetype",
-  "harfbuzz[icu,graphite2]",
+  "harfbuzz[graphite2]",
+  "icu",
 ] }
 x86_64-pc-windows-msvc = { triplet = "x64-windows-static-release", install = [
   "fontconfig",
   "freetype",
-  "harfbuzz[icu,graphite2]",
+  "harfbuzz[graphite2]",
+  "icu",
 ] }
 
 [package.metadata.internal_dep_versions]
 tectonic_bridge_core = "thiscommit:2023-06-11:PvhF7YB"
 tectonic_bridge_flate = "thiscommit:2021-01-01:eer4ahL4"
 tectonic_bridge_graphite2 = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
-tectonic_bridge_harfbuzz = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
-tectonic_bridge_icu = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
+tectonic_bridge_harfbuzz = "thiscommit:2023-09-17:FZwRtUP"
+tectonic_bridge_icu = "thiscommit:2023-09-17:AwTXf3W"
 tectonic_bundles = "thiscommit:2022-03-29:SFnXSaL"
 tectonic_cfg_support = "thiscommit:aeRoo7oa"
 tectonic_dep_support = "5faf4205bdd3d31101b749fc32857dd746f9e5bc"
diff --git a/crates/bridge_harfbuzz/Cargo.toml b/crates/bridge_harfbuzz/Cargo.toml
index 18d086e45e..0bf7d5bc9d 100644
--- a/crates/bridge_harfbuzz/Cargo.toml
+++ b/crates/bridge_harfbuzz/Cargo.toml
@@ -1,11 +1,11 @@
-# Copyright 2020-2021 the Tectonic Project
+# Copyright 2020-2023 the Tectonic Project
 # Licensed under the MIT License.
 
 # See README.md for discussion of features (or lack thereof) in this crate.
 
 [package]
 name = "tectonic_bridge_harfbuzz"
-version = "0.0.0-dev.0"  # assigned with cranko (see README)
+version = "0.0.0-dev.0" # assigned with cranko (see README)
 authors = ["Peter Williams <peter@newton.cx>"]
 description = """
 Expose the Harfbuzz C/C++ APIs to Rust/Cargo.
@@ -21,7 +21,6 @@ exclude = ["/harfbuzz/docs/", "/harfbuzz/perf/", "/harfbuzz/test/"]
 
 [dependencies]
 tectonic_bridge_graphite2 = { path = "../bridge_graphite2", version = "0.0.0-dev.0" }
-tectonic_bridge_icu = { path = "../bridge_icu", version = "0.0.0-dev.0" }
 
 [build-dependencies]
 cc = "^1.0.66"
@@ -32,5 +31,4 @@ external-harfbuzz = []
 
 [package.metadata.internal_dep_versions]
 tectonic_bridge_graphite2 = "2722731f9e32c6963fe8c8566a201b33672c5c5a"
-tectonic_bridge_icu = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
 tectonic_dep_support = "5faf4205bdd3d31101b749fc32857dd746f9e5bc"
diff --git a/crates/bridge_harfbuzz/build.rs b/crates/bridge_harfbuzz/build.rs
index b6d0a5c0b5..7db4b9e092 100644
--- a/crates/bridge_harfbuzz/build.rs
+++ b/crates/bridge_harfbuzz/build.rs
@@ -1,4 +1,4 @@
-// Copyright 2020 the Tectonic Project
+// Copyright 2020-2023 the Tectonic Project
 // Licensed under the MIT License.
 
 //! Harfbuzz build script.
@@ -7,15 +7,23 @@
 mod inner {
     use tectonic_dep_support::{Configuration, Dependency, Spec};
 
-    // TODO: ICU not necessary if Harfbuzz >= 2.5.
     struct HarfbuzzSpec;
 
     impl Spec for HarfbuzzSpec {
+        // We require Harfbuzz >= 1.4, but that version is ancient, and
+        // specifying the version constraint in this string causes problems with
+        // the `pkgconf` implementation of pkg-config on Windows/MSYS2.
+        // (Specifically, its `--modversion` mode won't print anything out when
+        // given two arguments, causing an unhandled crash inside the pkg_config
+        // Rust library.) Likewise, for Harfbuzz < 2.5, the `harfbuzz-icu`
+        // pkg-config item is needed, but this may also cause problems for
+        // pkgconf. If you really need to compile against very old Harfbuzz,
+        // patch this file and don't use pkgconf.
         fn get_pkgconfig_spec(&self) -> &str {
-            "harfbuzz >= 1.4 harfbuzz-icu"
+            "harfbuzz"
         }
 
-        // TODO: can we ensure that the ICU and graphite2 options are enabled?
+        // TODO: can we ensure that the graphite2 option is enabled?
         fn get_vcpkg_spec(&self) -> &[&str] {
             &["harfbuzz"]
         }
@@ -75,7 +83,6 @@ mod inner {
         // Include paths exported by our internal dependencies:
         let graphite2_include_path = env::var("DEP_GRAPHITE2_INCLUDE_PATH").unwrap();
         let graphite2_static = !env::var("DEP_GRAPHITE2_DEFINE_STATIC").unwrap().is_empty();
-        let icu_include_path = env::var("DEP_ICUUC_INCLUDE_PATH").unwrap();
 
         let mut cfg = cc::Build::new();
 
@@ -83,18 +90,12 @@ mod inner {
             .flag("-std=c++11")
             .warnings(false)
             .define("HAVE_GRAPHITE2", "1")
-            .define("HAVE_ICU", "1")
-            .file("harfbuzz/src/harfbuzz.cc")
-            .file("harfbuzz/src/hb-icu.cc");
+            .file("harfbuzz/src/harfbuzz.cc");
 
         for item in graphite2_include_path.split(';') {
             cfg.include(item);
         }
 
-        for item in icu_include_path.split(';') {
-            cfg.include(item);
-        }
-
         if graphite2_static {
             cfg.define("GRAPHITE2_STATIC", "1");
         }
@@ -129,10 +130,6 @@ mod inner {
             print!(";{}", item);
         }
 
-        for item in icu_include_path.split(';') {
-            print!(";{}", item);
-        }
-
         println!();
 
         let dest_dir = include_dir.join("harfbuzz");
diff --git a/crates/bridge_harfbuzz/src/lib.rs b/crates/bridge_harfbuzz/src/lib.rs
index 107ccadeb6..6f7e7e6017 100644
--- a/crates/bridge_harfbuzz/src/lib.rs
+++ b/crates/bridge_harfbuzz/src/lib.rs
@@ -1,4 +1,4 @@
-// Copyright 2020 the Tectonic Project
+// Copyright 2020-2023 the Tectonic Project
 // Licensed under the MIT License.
 
 //! No Rust code. This crate exists to export the Harfbuzz *C/C++* API into the
@@ -9,7 +9,4 @@
 mod linkage {
     #[allow(unused_imports)]
     use tectonic_bridge_graphite2 as clippyrenamehack1;
-
-    #[allow(unused_imports)]
-    use tectonic_bridge_icu as clippyrenamehack2;
 }
diff --git a/crates/bridge_icu/build.rs b/crates/bridge_icu/build.rs
index 88abf5e82a..f5cca0bdce 100644
--- a/crates/bridge_icu/build.rs
+++ b/crates/bridge_icu/build.rs
@@ -7,7 +7,7 @@
 //! this crate is needed. Vendoring the ICU library is almost certainly not
 //! something that one should do.
 
-use tectonic_dep_support::{Configuration, Dependency, Spec};
+use tectonic_dep_support::{Backend, Configuration, Dependency, Spec};
 
 struct IcuSpec;
 
@@ -22,6 +22,7 @@ impl Spec for IcuSpec {
 }
 
 fn main() {
+    let target = std::env::var("TARGET").unwrap();
     let cfg = Configuration::default();
     let dep = Dependency::probe(IcuSpec, &cfg);
 
@@ -39,4 +40,14 @@ fn main() {
     println!();
 
     dep.emit();
+
+    // vcpkg-rs is not guaranteed to emit libraries in the order required by a
+    // single-pass linker, so we might need to make sure that's done right.
+
+    if cfg.backend == Backend::Vcpkg && target.contains("-linux-") {
+        // add icudata to the end of the list of libs as vcpkg-rs
+        // does not order individual libraries as a single pass
+        // linker requires.
+        println!("cargo:rustc-link-lib=icudata");
+    }
 }
diff --git a/crates/xetex_layout/Cargo.toml b/crates/xetex_layout/Cargo.toml
index f9ce92d87a..a6f73d08f1 100644
--- a/crates/xetex_layout/Cargo.toml
+++ b/crates/xetex_layout/Cargo.toml
@@ -5,7 +5,7 @@
 
 [package]
 name = "tectonic_xetex_layout"
-version = "0.0.0-dev.0"  # assigned with cranko (see README)
+version = "0.0.0-dev.0" # assigned with cranko (see README)
 authors = ["Peter Williams <peter@newton.cx>"]
 description = """
 XeTeX's font loading and layout interface encapsulation, as a crate.
@@ -38,6 +38,6 @@ tectonic_bridge_core = "thiscommit:2021-01-16:wie2Ejoh"
 tectonic_bridge_graphite2 = "2722731f9e32c6963fe8c8566a201b33672c5c5a"
 tectonic_bridge_freetype2 = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
 tectonic_bridge_harfbuzz = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
-tectonic_bridge_icu = "2c1ffcd702a662c003bd3d7d0ca4d169784cb6ad"
+tectonic_bridge_icu = "thiscommit:2023-09-17:6uIZ4lA"
 tectonic_cfg_support = "thiscommit:aeRoo7oa"
 tectonic_dep_support = "5faf4205bdd3d31101b749fc32857dd746f9e5bc"
diff --git a/crates/xetex_layout/build.rs b/crates/xetex_layout/build.rs
index 551364332a..bdd0d03fcf 100644
--- a/crates/xetex_layout/build.rs
+++ b/crates/xetex_layout/build.rs
@@ -13,7 +13,7 @@ use std::{
     path::{Path, PathBuf},
 };
 use tectonic_cfg_support::target_cfg;
-use tectonic_dep_support::{Backend, Configuration, Dependency, Spec};
+use tectonic_dep_support::{Configuration, Dependency, Spec};
 
 struct FontconfigSpec;
 
@@ -188,16 +188,6 @@ fn main() {
 
     deps.emit();
 
-    // vcpkg-rs is not guaranteed to emit libraries in the order required by a
-    // single-pass linker, so we might need to make sure that's done right.
-
-    if dep_cfg.backend == Backend::Vcpkg && target.contains("-linux-") {
-        // add icudata to the end of the list of libs as vcpkg-rs
-        // does not order individual libraries as a single pass
-        // linker requires.
-        println!("cargo:rustc-link-lib=icudata");
-    }
-
     // Copy the static header file for C preprocessing convenience.
 
     let mut main_header_src = manifest_dir;
diff --git a/crates/xetex_layout/layout/xetex-XeTeXLayoutInterface.cpp b/crates/xetex_layout/layout/xetex-XeTeXLayoutInterface.cpp
index f22c283330..89c1de6a10 100644
--- a/crates/xetex_layout/layout/xetex-XeTeXLayoutInterface.cpp
+++ b/crates/xetex_layout/layout/xetex-XeTeXLayoutInterface.cpp
@@ -40,6 +40,7 @@ authorization from the copyright holders.
 #include <harfbuzz/hb.h>
 #include <harfbuzz/hb-graphite2.h>
 #if !HB_VERSION_ATLEAST(2,5,0)
+/* Note: this configuration is no longer actively tested */
 #include <harfbuzz/hb-icu.h>
 #endif
 #include <harfbuzz/hb-ot.h>
diff --git a/dist/azure-build-and-test-pkgconfig.yml b/dist/azure-build-and-test-pkgconfig.yml
index 3041ca6e40..5bb2ccd22a 100644
--- a/dist/azure-build-and-test-pkgconfig.yml
+++ b/dist/azure-build-and-test-pkgconfig.yml
@@ -1,4 +1,4 @@
-# Copyright 2016-2020 the Tectonic Project
+# Copyright 2016-2023 the Tectonic Project
 # Licensed under the MIT License.
 #
 # Azure Pipelines template for a standard build-and-test job getting
@@ -32,9 +32,12 @@ steps:
 - bash: |
     set -xeuo pipefail
 
+    # libfuse2 here is to support the AppImage build associated with
+    # the "primary" Linux artifact.
     pkgs="
       libgraphite2-dev
       libfontconfig1-dev
+      libfuse2
       libicu-dev
       libssl-dev
       openssl
diff --git a/dist/azure-build-and-test.yml b/dist/azure-build-and-test.yml
index 9007dc8eb5..efc347f073 100644
--- a/dist/azure-build-and-test.yml
+++ b/dist/azure-build-and-test.yml
@@ -18,7 +18,7 @@ parameters:
   type: object
   default:
   - name: linux_stable_semistatic
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       primaryBuild: true
     vars:
@@ -27,7 +27,7 @@ parameters:
       TECTONIC_PKGCONFIG_FORCE_SEMI_STATIC: true
 
   - name: linux_stable_extdeps
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
       installAllDeps: true
@@ -37,7 +37,7 @@ parameters:
       TOOLCHAIN: stable
 
   - name: linux_stable_intdeps
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
       installAllDeps: false
@@ -46,7 +46,7 @@ parameters:
       TOOLCHAIN: stable
 
   - name: linux_beta
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
     vars:
@@ -54,7 +54,7 @@ parameters:
       TOOLCHAIN: beta
 
   - name: linux_nightly
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
     vars:
@@ -99,7 +99,7 @@ parameters:
       TOOLCHAIN: stable-x86_64-pc-windows-gnu
 
   - name: linux_ftmtx_none
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
       installAllDeps: false
@@ -109,7 +109,7 @@ parameters:
       TOOLCHAIN: stable
 
   - name: linux_ftmtx_all
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
       installAllDeps: true
@@ -119,7 +119,7 @@ parameters:
       TOOLCHAIN: stable
 
   - name: linux_ftmtx_curl
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
       installAllDeps: true
@@ -133,7 +133,7 @@ parameters:
   type: object
   default:
   - name: x86_64_unknown_linux_gnu
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-22.04
     params:
       canaryBuild: true
     vars:
@@ -186,7 +186,7 @@ jobs:
 # rustfmt check
 - job: rustfmt
   pool:
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-latest
   steps:
     - bash: rustup component add rustfmt
       displayName: "Install rustfmt"
@@ -198,7 +198,7 @@ jobs:
 # clippy check
 - job: clippy
   pool:
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-latest
   steps:
     - template: azure-generic-build-setup.yml
     - bash: |
@@ -251,7 +251,7 @@ jobs:
 - ${{ each build in parameters.crossBuilds }}:
   - job: ${{ format('cross_{0}', build.name) }}
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-22.04
     steps:
     - template: azure-build-and-test-cross.yml
     variables:
@@ -261,7 +261,7 @@ jobs:
 # coverage analysis check
 - job: coverage
   pool:
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-latest
   steps:
     - template: azure-coverage.yml
   variables:
@@ -270,7 +270,7 @@ jobs:
 # book build
 - job: book
   pool:
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-latest
   steps:
   - template: azure-generic-build-setup.yml
   - bash: |
diff --git a/dist/azure-deployment.yml b/dist/azure-deployment.yml
index 56f8adba6a..e87bbc31fc 100644
--- a/dist/azure-deployment.yml
+++ b/dist/azure-deployment.yml
@@ -1,4 +1,4 @@
-# Copyright 2016-2020 the Tectonic Project
+# Copyright 2016-2023 the Tectonic Project
 # Licensed under the MIT License.
 #
 # Deployment pipeline, run when all CI tests pass on `master` or `rc`.
@@ -22,7 +22,7 @@ jobs:
 # Things that should happen in either main-dev *or* release mode.
 - job: update_book
   pool:
-    vmImage: ubuntu-20.04
+    vmImage: ubuntu-latest
   variables:
     - group: Deployment Credentials
   steps:
@@ -49,7 +49,7 @@ jobs:
 - ${{ if parameters.isMainDev }}:
   - job: recreate_continuous
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-latest
     variables:
     - group: Deployment Credentials
     steps:
@@ -79,7 +79,7 @@ jobs:
 - ${{ if parameters.isRelease }}:
   - job: branch_and_tag
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-latest
     variables:
     - group: Deployment Credentials
     steps:
@@ -98,7 +98,7 @@ jobs:
 
   - job: cargo_publish
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-latest
     variables:
     - group: Deployment Credentials
     steps:
@@ -116,7 +116,7 @@ jobs:
   - job: github_releases
     dependsOn: branch_and_tag # otherwise, GitHub will create the tag itself
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-latest
     variables:
     - group: Deployment Credentials
     steps:
@@ -145,7 +145,7 @@ jobs:
 
   - job: update_website
     pool:
-      vmImage: ubuntu-20.04
+      vmImage: ubuntu-latest
     variables:
       - group: Deployment Credentials
     steps:
diff --git a/dist/azure-generic-build.yml b/dist/azure-generic-build.yml
index 25d9310731..370946521b 100644
--- a/dist/azure-generic-build.yml
+++ b/dist/azure-generic-build.yml
@@ -1,4 +1,4 @@
-# Copyright 2016-2020 the Tectonic Project
+# Copyright 2016-2023 the Tectonic Project
 # Licensed under the MIT License.
 #
 # Azure Pipelines template for a standard build-and-test workflow once
@@ -46,6 +46,11 @@ steps:
     echo "Cargo features for this build: $ffs --features=\"$fts\""
     echo "##vso[task.setvariable variable=CARGO_FEATURES_EXPLICIT;]$fts"
     echo "##vso[task.setvariable variable=CARGO_FEATURES_FLAGS;]$ffs"
+
+    # OK, these have nothing to do with features, but if a build script fails, it
+    # can be helpful to get a full backtrace.
+    echo "##vso[task.setvariable variable=RUST_BACKTRACE;]full"
+    echo "##vso[task.setvariable variable=CARGO_PROFILE_RELEASE_BUILD_OVERRIDE_DEBUG;]true"
   displayName: Set feature flags
   env:
     DEFAULT_FEATURES_FLAG: ${{ parameters.defaultFeatures }}
@@ -74,7 +79,8 @@ steps:
       artifactName: binary-$(TARGET)
 
   # If, further, we're the primary build, do some stuff that should only happen
-  # once among all of the build jobs.
+  # once among all of the build jobs. TODO: this should probably be handled as
+  # part of our deployment stage, now that we have a more refined CI/CD workflow.
 
   - ${{ if eq(parameters.primaryBuild, true) }}:
     - bash: |
diff --git a/docs/src/howto/build-tectonic/external-dep-install.md b/docs/src/howto/build-tectonic/external-dep-install.md
index aea6117f36..5b6836c20c 100644
--- a/docs/src/howto/build-tectonic/external-dep-install.md
+++ b/docs/src/howto/build-tectonic/external-dep-install.md
@@ -101,5 +101,5 @@ should probably run:
 [vcpkg]: https://vcpkg.readthedocs.io/
 
 ```sh
-vcpkg install fontconfig freetype "harfbuzz[icu,graphite2]"
+vcpkg install fontconfig freetype "harfbuzz[graphite2]" icu
 ```