diff --git a/pom.xml b/pom.xml
index 0bccf1fa..8138024d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -76,10 +76,16 @@
             <dependency>
                 <groupId>io.jenkins.tools.bom</groupId>
                 <artifactId>bom-${jenkins.baseline}.x</artifactId>
-                <version>3850.vb_c5319efa_e29</version>
+                <version>4023.va_eeb_b_4e45f07</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
+            <dependency>
+                <groupId>org.jenkins-ci.plugins.workflow</groupId>
+                <artifactId>workflow-cps</artifactId>
+                <!-- TODO https://github.com/jenkinsci/workflow-cps-plugin/pull/988 -->
+                <version>999999-SNAPSHOT</version>
+            </dependency>
         </dependencies>
     </dependencyManagement>
     <dependencies>
@@ -107,7 +113,8 @@
             <!-- Required for running with Java 9+ -->
             <groupId>org.jboss.marshalling</groupId>
             <artifactId>jboss-marshalling-river</artifactId>
-            <version>2.2.2.Final</version>
+            <!-- TODO https://github.com/jboss-remoting/jboss-marshalling/pull/161 -->
+            <version>2.3.0.Final-SNAPSHOT</version>
         </dependency>
         <dependency>
             <groupId>org.jenkins-ci.plugins.workflow</groupId>
@@ -172,5 +179,30 @@
             <artifactId>pipeline-stage-step</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.csanchez.jenkins.plugins</groupId>
+            <artifactId>kubernetes</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jenkins-ci.plugins</groupId>
+            <artifactId>pipeline-maven</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jenkinsci.plugins</groupId>
+            <artifactId>pipeline-model-definition</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>io.jenkins.plugins</groupId>
+            <artifactId>warnings-ng</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.jenkins-ci.plugins</groupId>
+            <artifactId>parallel-test-executor</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 </project>
diff --git a/src/main/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReader.java b/src/main/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReader.java
index 2a4264fc..7307005f 100644
--- a/src/main/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReader.java
+++ b/src/main/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReader.java
@@ -114,7 +114,7 @@ public RiverReader(File f, ClassLoader classLoader, FlowExecutionOwner owner) th
         this.owner = owner;
     }
 
-    private int parseHeader(DataInputStream din) throws IOException {
+    static int parseHeader(DataInputStream din) throws IOException {
         if (din.readLong() != RiverWriter.HEADER) {
             throw new IOException("Invalid stream header");
         }
diff --git a/src/test/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReaderStackOverflowErrorDiag.java b/src/test/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReaderStackOverflowErrorDiag.java
new file mode 100644
index 00000000..78a1f1cb
--- /dev/null
+++ b/src/test/java/org/jenkinsci/plugins/workflow/support/pickles/serialization/RiverReaderStackOverflowErrorDiag.java
@@ -0,0 +1,76 @@
+/*
+ * The MIT License
+ *
+ * Copyright 2025 CloudBees, Inc.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+package org.jenkinsci.plugins.workflow.support.pickles.serialization;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.apache.commons.io.FileUtils;
+import org.jenkinsci.plugins.workflow.cps.CpsFlowExecution;
+import org.jenkinsci.plugins.workflow.job.WorkflowJob;
+import org.jenkinsci.plugins.workflow.job.WorkflowRun;
+import static org.junit.Assume.assumeNotNull;
+import org.junit.BeforeClass;
+import org.junit.Rule;
+import org.junit.Test;
+import org.jvnet.hudson.test.JenkinsSessionRule;
+
+public final class RiverReaderStackOverflowErrorDiag {
+
+    private static Path input;
+
+    @BeforeClass public static void args() {
+        var path = System.getenv("BUILD_DIR");
+        assumeNotNull("Define $BUILD_DIR to run", path);
+        input = Path.of(path);
+    }
+
+    @Rule public JenkinsSessionRule rr = new JenkinsSessionRule();
+
+    @Test public void run() throws Throwable {
+        var jobDir = rr.getHome().toPath().resolve("jobs/xxx");
+        var buildDir = jobDir.resolve("builds/1");
+        FileUtils.copyDirectory(input.toFile(), buildDir.toFile());
+        Files.writeString(jobDir.resolve("config.xml"), "<flow-definition/>"); // minimal WorkflowJob
+        var buildXml = buildDir.resolve("build.xml");
+        Files.writeString(buildXml, Files.readString(buildXml).
+            replace("<completed>true</completed>", "<completed>false</completed>").
+            replace("<done>true</done>", "<done>false</done>").
+            replaceFirst("<head>1:[0-9]+</head>", "<!-- no heads -->"));
+        Files.writeString(buildDir.resolve("log"), "<original log redacted>\n");
+        System.err.println("Loading " + input);
+        rr.then(r -> {
+            // TODO turn down logging on OldDataMonitor (we do not care about missing classes in build.xml)
+            var build = r.jenkins.getItemByFullName("xxx", WorkflowJob.class).getBuildByNumber(1);
+            try {
+                ((CpsFlowExecution) build.getExecution()).programPromise.get();
+                System.err.println("Loaded.");
+            } catch (Exception x) {
+                x.printStackTrace();
+                build.writeWholeLogTo(System.err);
+            }
+        });
+    }
+
+}