diff --git a/site-cookbooks/kosmos-bitcoin/attributes/default.rb b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
index 84a081b..f7763f8 100644
--- a/site-cookbooks/kosmos-bitcoin/attributes/default.rb
+++ b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
@@ -60,9 +60,10 @@ node.default['lnd']['tor'] = {
 }
 
 node.default['rtl']['repo'] = 'https://github.com/Ride-The-Lightning/RTL.git'
-node.default['rtl']['revision'] = 'v0.15.2'
+node.default['rtl']['revision'] = 'v0.15.15'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
+node.default['rtl']['block_explorer_url'] = 'https://mempool.space'
 
 node.default['lndhub-go']['repo'] = 'https://github.com/getAlby/lndhub.go.git'
 node.default['lndhub-go']['revision'] = '1.0.2'
diff --git a/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb b/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb
index e19e829..867fb4f 100644
--- a/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/rtl.rb
@@ -16,6 +16,9 @@ credentials   = Chef::EncryptedDataBagItem.load('credentials', 'rtl')
 rtl_config = {
   host: node['rtl']['host'],
   port: node['rtl']['port'],
+  # Since RTL 0.15.14 the block explorer URL can only be set here (or via
+  # BLOCK_EXPLORER_URL); it is no longer settable from the settings UI.
+  blockExplorerUrl: node['rtl']['block_explorer_url'],
   defaultNodeIndex: 1,
   SSO: {
     rtlSSO: 0,
@@ -46,6 +49,17 @@ rtl_config = {
   multiPassHashed: credentials["multiPassHashed"]
 }
 
+# Discard any local modifications (e.g. a rewritten package-lock.json) so the
+# checkout below to the pinned revision succeeds.
+execute "reset rtl checkout" do
+  command "git checkout -- ."
+  cwd rtl_dir
+  user bitcoin_user
+  group bitcoin_group
+  environment "HOME" => rtl_dir
+  only_if { ::File.directory?("#{rtl_dir}/.git") }
+end
+
 git rtl_dir do
   user bitcoin_user
   group bitcoin_group
@@ -59,8 +73,8 @@ execute "npm_install" do
   cwd rtl_dir
   environment "HOME" => rtl_dir
   user bitcoin_user
-  # TODO remove --force when upstream dependency issues have been resolved
-  command "npm install --force"
+  # Clean install from the committed lockfile, as recommended since RTL 0.15.6.
+  command "npm ci --omit=dev --legacy-peer-deps"
   action :nothing
 end