diff --git a/var/spack/repos/builtin/packages/py-cylc-flow/package.py b/var/spack/repos/builtin/packages/py-cylc-flow/package.py
index 2fe1d5dd4a863e..24899ce4c24b44 100644
--- a/var/spack/repos/builtin/packages/py-cylc-flow/package.py
+++ b/var/spack/repos/builtin/packages/py-cylc-flow/package.py
@@ -11,16 +11,19 @@ class PyCylcFlow(PythonPackage):
 
     homepage = "https://cylc.org"
     pypi = "cylc-flow/cylc-flow-8.1.4.tar.gz"
+    git = "https://github.com/cylc/cylc-flow.git"
 
     maintainers("LydDeb", "climbfuji")
 
     license("GPL-3.0-only")
 
+    # 8.3.6 not on PyPI server?
+    version("8.3.6", commit="7f63b43164638e27636b992b14b3fa088b692b94")
     version("8.2.3", sha256="dd5bea9e4b8dad00edd9c3459a38fb778e5a073da58ad2725bc9b84ad718e073")
     version("8.2.0", sha256="cbe35e0d72d1ca36f28a4cebe9b9040a3445a74253bc94051a3c906cf179ded0")
     version("8.1.4", sha256="d1835ac18f6f24f3115c56b2bc821185484e834a86b12fd0033ff7e4dc3c1f63")
 
-    depends_on("py-setuptools@49:66,68:", type=("build", "run"))
+    depends_on("py-setuptools@49:66,68:", type=("build", "run"), when="@:8.2")
     depends_on("py-aiofiles@0.7", type=("build", "run"), when="@:8.1")
     depends_on("py-ansimarkup@1.0.0:", type=("build", "run"))
     depends_on("py-async-timeout@3.0.0:", type=("build", "run"))
@@ -29,15 +32,33 @@ class PyCylcFlow(PythonPackage):
     depends_on("py-jinja2@3.0", type=("build", "run"))
     depends_on("py-metomi-isodatetime@3.0", type=("build", "run"), when="@:8.2.0")
     depends_on("py-metomi-isodatetime@3:3.1", type=("build", "run"), when="@8.2.3:")
-    depends_on("py-protobuf@4.21.2:4.21", type=("build", "run"))
+    depends_on("py-packaging", type=("build", "run"), when="@8.3:")
+    depends_on("py-protobuf@4.21.2:4.21", type=("build", "run"), when="@:8.2")
+    depends_on("py-protobuf@4.24.4:4.24", type=("build", "run"), when="@8.3:")
     depends_on("py-psutil@5.6.0:", type=("build", "run"))
     depends_on("py-pyzmq@22:", type=("build", "run"), when="@8.2:")
     depends_on("py-pyzmq@22", type=("build", "run"), when="@:8.1")
-    depends_on("py-importlib-metadata", type=("build", "run"), when="^python@:3.7")
-    depends_on("py-urwid@2", type=("build", "run"))
+    depends_on("py-importlib-metadata", type=("build", "run"), when="@:8.2 ^python@:3.7")
+    depends_on("py-importlib-metadata@5:", type=("build", "run"), when="@8.3: ^python@:3.11")
+    depends_on("py-urwid@2:2.6.1,2.6.4:2", type=("build", "run"))
     depends_on("py-rx", type=("build", "run"))
     depends_on("py-promise", type=("build", "run"))
     depends_on("py-tomli@2:", type=("build", "run"), when="^python@:3.10")
 
     # Non-Python dependencies
     depends_on("graphviz", type="run")
+
+    # cylc thinks it's smarter than everyone else and unsets
+    # PYTHONPATH, then sets it from CYLC_PYTHONPATH ...
+    # https://github.com/cylc/cylc-flow/issues/5124
+    # We need to filter this out, spack knows what it is doing.
+    @run_after("install")
+    def fix_cylc_pythonpath_mangling(self):
+        python_version = self.spec["python"].version.up_to(2)
+        pydir = join_path(self.prefix.lib, "python{0}".format(python_version), "site-packages")
+        cylc_dot_py = join_path(pydir, "cylc/flow/scripts/cylc.py")
+        filter_file(
+            r"^pythonpath_manip\(\)$",
+            "# spack knows what it is doing, skip 'pythonpath_manip()'",
+            cylc_dot_py,
+        )
diff --git a/var/spack/repos/builtin/packages/py-protobuf/package.py b/var/spack/repos/builtin/packages/py-protobuf/package.py
index dbd674eac1bea6..839d27aaa8d3bc 100644
--- a/var/spack/repos/builtin/packages/py-protobuf/package.py
+++ b/var/spack/repos/builtin/packages/py-protobuf/package.py
@@ -21,6 +21,7 @@ class PyProtobuf(PythonPackage):
     version("5.27.5", sha256="7fa81bc550201144a32f4478659da06e0b2ebe4d5303aacce9a202a1c3d5178d")
     version("5.26.1", sha256="8ca2a1d97c290ec7b16e4e5dff2e5ae150cc1582f55b5ab300d45cb0dfa90e51")
     version("4.25.3", sha256="25b5d0b42fd000320bd7830b349e3b696435f3b329810427a6bcce6a5492cc5c")
+    version("4.24.4", sha256="5a70731910cd9104762161719c3d883c960151eea077134458503723b60e3667")
     version("4.24.3", sha256="12e9ad2ec079b833176d2921be2cb24281fa591f0b119b208b788adc48c2561d")
     version("4.23.3", sha256="7a92beb30600332a52cdadbedb40d33fd7c8a0d7f549c440347bc606fb3fe34b")
     version("4.21.9", sha256="61f21493d96d2a77f9ca84fefa105872550ab5ef71d21c458eb80edcf4885a99")