diff --git a/.jenkins.d/00-deps.sh b/.jenkins.d/00-deps.sh
index 660fad6..617f383 100755
--- a/.jenkins.d/00-deps.sh
+++ b/.jenkins.d/00-deps.sh
@@ -8,31 +8,37 @@
 
 if has OSX $NODE_LABELS; then
     FORMULAE=(boost openssl pkg-config)
-    brew update
-    if [[ -n $TRAVIS ]]; then
-        # Travis images come with a large number of brew packages
-        # pre-installed, don't waste time upgrading all of them
-        for FORMULA in "${FORMULAE[@]}"; do
-            brew outdated $FORMULA || brew upgrade $FORMULA
-        done
-    else
-        brew upgrade
+    if has OSX-10.13 $NODE_LABELS || has OSX-10.14 $NODE_LABELS; then
+        FORMULAE+=(python)
     fi
-    brew install "${FORMULAE[@]}"
-    brew cleanup
-fi
 
-if has Ubuntu $NODE_LABELS; then
+    if [[ -n $TRAVIS ]]; then
+        # Travis images come with a large number of pre-installed
+        # brew packages, don't waste time upgrading all of them
+        brew list --versions "${FORMULAE[@]}" || brew update
+        for FORMULA in "${FORMULAE[@]}"; do
+            brew list --versions "$FORMULA" || brew install "$FORMULA"
+        done
+        # Ensure /usr/local/opt/openssl exists
+        brew reinstall openssl
+    else
+        brew update
+        brew upgrade
+        brew install "${FORMULAE[@]}"
+        brew cleanup
+    fi
+
+elif has Ubuntu $NODE_LABELS; then
     sudo apt-get -qq update
-    sudo apt-get -qy install build-essential pkg-config libboost-all-dev \
-                             libsqlite3-dev libssl-dev libpcap-dev
+    sudo apt-get -qy install g++ pkg-config python3-minimal \
+                             libboost-all-dev libssl-dev libsqlite3-dev \
+                             libpcap-dev
 
     if [[ $JOB_NAME == *"code-coverage" ]]; then
         sudo apt-get -qy install gcovr lcov libgd-perl
     fi
-fi
 
-if has CentOS-7 $NODE_LABELS; then
+elif has CentOS-7 $NODE_LABELS; then
     sudo yum -y install yum-utils pkgconfig \
                         openssl-devel libtranslit-icu \
                         python-devel sqlite-devel \
diff --git a/.jenkins.d/01-ndn-cxx.sh b/.jenkins.d/01-ndn-cxx.sh
index bec70d4..0ae5022 100755
--- a/.jenkins.d/01-ndn-cxx.sh
+++ b/.jenkins.d/01-ndn-cxx.sh
@@ -43,7 +43,7 @@
 pushd ndn-cxx >/dev/null
 
 ./waf --color=yes configure --disable-static --enable-shared --without-osx-keychain
-./waf --color=yes build -j${WAF_JOBS:-1}
+./waf --color=yes build -j$WAF_JOBS
 sudo_preserve_env PATH -- ./waf --color=yes install
 
 popd >/dev/null
diff --git a/.jenkins.d/10-build.sh b/.jenkins.d/10-build.sh
index 5748dc4..ccbcc93 100755
--- a/.jenkins.d/10-build.sh
+++ b/.jenkins.d/10-build.sh
@@ -6,34 +6,34 @@
 
 set -x
 
+git submodule sync
+git submodule update --init
+
 if [[ $JOB_NAME == *"code-coverage" ]]; then
     COVERAGE="--with-coverage"
 elif [[ -z $DISABLE_ASAN ]]; then
     ASAN="--with-sanitizer=address"
 fi
 
-# Cleanup
-sudo_preserve_env PATH -- ./waf --color=yes distclean
-
 if [[ $JOB_NAME != *"code-coverage" && $JOB_NAME != *"limited-build" ]]; then
     # Build in release mode with tests
     ./waf --color=yes configure --with-tests
-    ./waf --color=yes build -j${WAF_JOBS:-1}
+    ./waf --color=yes build -j$WAF_JOBS
 
     # Cleanup
-    sudo_preserve_env PATH -- ./waf --color=yes distclean
+    ./waf --color=yes distclean
 
     # Build in release mode without tests
     ./waf --color=yes configure
-    ./waf --color=yes build -j${WAF_JOBS:-1}
+    ./waf --color=yes build -j$WAF_JOBS
 
     # Cleanup
-    sudo_preserve_env PATH -- ./waf --color=yes distclean
+    ./waf --color=yes distclean
 fi
 
 # Build in debug mode with tests
 ./waf --color=yes configure --debug --with-tests $ASAN $COVERAGE
-./waf --color=yes build -j${WAF_JOBS:-1}
+./waf --color=yes build -j$WAF_JOBS
 
 # (tests will be run against the debug version)
 
diff --git a/.jenkins.d/20-tests.sh b/.jenkins.d/20-tests.sh
index 816a792..c216d3c 100755
--- a/.jenkins.d/20-tests.sh
+++ b/.jenkins.d/20-tests.sh
@@ -7,9 +7,9 @@
 set -x
 
 # Prepare environment
-rm -Rf ~/.ndn
+rm -rf ~/.ndn
 
-BOOST_VERSION=$(python -c "import sys; sys.path.append('build/c4che'); import _cache; print(_cache.BOOST_VERSION_NUMBER);")
+BOOST_VERSION=$(python3 -c "import sys; sys.path.append('build/c4che'); import _cache; print(_cache.BOOST_VERSION_NUMBER);")
 
 ut_log_args() {
     if (( BOOST_VERSION >= 106200 )); then
@@ -24,13 +24,14 @@
     fi
 }
 
+# https://github.com/google/sanitizers/wiki/AddressSanitizerFlags
 ASAN_OPTIONS="color=always"
-ASAN_OPTIONS+=":detect_stack_use_after_return=true"
-ASAN_OPTIONS+=":check_initialization_order=true"
-ASAN_OPTIONS+=":strict_init_order=true"
+ASAN_OPTIONS+=":check_initialization_order=1"
+ASAN_OPTIONS+=":detect_stack_use_after_return=1"
+ASAN_OPTIONS+=":strict_init_order=1"
+ASAN_OPTIONS+=":strict_string_checks=1"
 ASAN_OPTIONS+=":detect_invalid_pointer_pairs=1"
-ASAN_OPTIONS+=":detect_container_overflow=false"
-ASAN_OPTIONS+=":strict_string_checks=true"
+ASAN_OPTIONS+=":detect_container_overflow=0"
 ASAN_OPTIONS+=":strip_path_prefix=${PWD}/"
 export ASAN_OPTIONS