diff --git a/lib/rubygems.rb b/lib/rubygems.rb
index e4eca64fe14981..0c40f8482f38d0 100644
--- a/lib/rubygems.rb
+++ b/lib/rubygems.rb
@@ -298,6 +298,13 @@ def self.activate_and_load_bin_path(name, exec_name = nil, *requirements)
     spec = find_and_activate_spec_for_exe name, exec_name, requirements
 
     if spec.name == "bundler"
+      # Old versions of Bundler need a workaround to support nested `bundle
+      # exec` invocations by overriding `Gem.activate_bin_path`. However,
+      # RubyGems now uses this new `Gem.activate_and_load_bin_path` helper in
+      # binstubs, which is of course not overridden in Bundler since it didn't
+      # exist at the time. So, include the override here to workaround that.
+      load ENV["BUNDLE_BIN_PATH"] if ENV["BUNDLE_BIN_PATH"] && spec.version <= "2.5.22"
+
       # Make sure there's no version of Bundler in `$LOAD_PATH` that's different
       # from the version we just activated. If that was the case (it happens
       # when testing Bundler from ruby/ruby), we would load Bundler extensions
diff --git a/test/ruby/test_zjit.rb b/test/ruby/test_zjit.rb
index 1166533bd9e8b0..69c440f5f08fba 100644
--- a/test/ruby/test_zjit.rb
+++ b/test/ruby/test_zjit.rb
@@ -806,6 +806,11 @@ def test
       def a(n1,n2,n3,n4,n5,n6,n7,n8,n9) = n1+n9
       a(2,0,0,0,0,0,0,0,-1)
     }
+
+    assert_compiles '0', %q{
+      def a(n1,n2,n3,n4,n5,n6,n7,n8) = n8
+      a(1,1,1,1,1,1,1,0)
+    }
   end
 
   def test_opt_aref_with
diff --git a/tool/rbs_skip_tests b/tool/rbs_skip_tests
index e8a10cf1459fee..6de4cce6e74e87 100644
--- a/tool/rbs_skip_tests
+++ b/tool/rbs_skip_tests
@@ -79,3 +79,6 @@ CGISingletonTest CGI is retired
 RactorSingletonTest Ractor API was changed https://bugs.ruby-lang.org/issues/21262
 RactorInstanceTest  Ractor API was changed https://bugs.ruby-lang.org/issues/21262
 
+# https://github.com/ruby/fileutils/pull/139
+# https://github.com/ruby/actions/actions/runs/16425309325/job/46414287784
+test_ln_sr(FileUtilsSingletonTest)
diff --git a/zjit/src/codegen.rs b/zjit/src/codegen.rs
index 6ce39159784b04..54346e077806c4 100644
--- a/zjit/src/codegen.rs
+++ b/zjit/src/codegen.rs
@@ -898,6 +898,10 @@ fn gen_return(jit: &JITState, asm: &mut Assembler, val: lir::Opnd) -> Option<()>
     asm.mov(CFP, incr_cfp);
     asm.mov(Opnd::mem(64, EC, RUBY_OFFSET_EC_CFP), CFP);
 
+    // Order here is important. Because we're about to tear down the frame,
+    // we need to load the return value, which might be part of the frame.
+    asm.load_into(C_RET_OPND, val);
+
     // Restore the C stack pointer bumped for basic block arguments
     if jit.c_stack_bytes > 0 {
         asm_comment!(asm, "restore C stack pointer");
@@ -908,7 +912,7 @@ fn gen_return(jit: &JITState, asm: &mut Assembler, val: lir::Opnd) -> Option<()>
     asm.frame_teardown();
 
     // Return from the function
-    asm.cret(val);
+    asm.cret(C_RET_OPND);
     Some(())
 }