diff --git a/.busbar-ref b/.busbar-ref
index 2191601..5273b3b 100644
--- a/.busbar-ref
+++ b/.busbar-ref
@@ -1 +1 @@
-179abf2c10cf1406778300ef1f1b3964cc229727 1.6.0
+68df8203a98da0c71ec6049bbe92fc83fde25ae6 1.6.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1d9f1a..76b4c68 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@179abf2c10cf1406778300ef1f1b3964cc229727
+    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@68df8203a98da0c71ec6049bbe92fc83fde25ae6
     with:
       service: wiremock
       busbar_checkout: true
diff --git a/.github/workflows/consumer-verify.yml b/.github/workflows/consumer-verify.yml
index 4b15ad5..4eb2810 100644
--- a/.github/workflows/consumer-verify.yml
+++ b/.github/workflows/consumer-verify.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   consumer:
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@179abf2c10cf1406778300ef1f1b3964cc229727
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@68df8203a98da0c71ec6049bbe92fc83fde25ae6
     with:
       version: ${{ inputs.version || '' }}
       asset_prefix: busbar-auth-github
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bcb84db..814275a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
     secrets: inherit
   release:
     needs: ci
-    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@179abf2c10cf1406778300ef1f1b3964cc229727
+    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@68df8203a98da0c71ec6049bbe92fc83fde25ae6
     with:
       plugin_crate: busbar-auth-github-plugin
       manifest_name: busbar-auth-github
@@ -42,7 +42,7 @@ jobs:
   consumer-verify:
     needs: release
     if: ${{ !cancelled() }}
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@179abf2c10cf1406778300ef1f1b3964cc229727
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@68df8203a98da0c71ec6049bbe92fc83fde25ae6
     with:
       version: ${{ github.ref_name }}
       asset_prefix: busbar-auth-github
diff --git a/.github/workflows/repin.yml b/.github/workflows/repin.yml
index c60ca3c..83fcef7 100644
--- a/.github/workflows/repin.yml
+++ b/.github/workflows/repin.yml
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   repin:
-    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@179abf2c10cf1406778300ef1f1b3964cc229727
+    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@68df8203a98da0c71ec6049bbe92fc83fde25ae6
     with:
       busbar_sha: ${{ github.event.client_payload.sha || inputs.busbar_sha }}
       busbar_version: ${{ github.event.client_payload.version || inputs.busbar_version }}
diff --git a/Cargo.lock b/Cargo.lock
index 38949d8..838ce36 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -83,7 +83,7 @@ dependencies = [
 [[package]]
 name = "busbar-contract"
 version = "1.6.0"
-source = "git+https://www.github.com/GetBusbar/busbar?rev=179abf2c10cf1406778300ef1f1b3964cc229727#179abf2c10cf1406778300ef1f1b3964cc229727"
+source = "git+https://www.github.com/GetBusbar/busbar?rev=68df8203a98da0c71ec6049bbe92fc83fde25ae6#68df8203a98da0c71ec6049bbe92fc83fde25ae6"
 dependencies = [
  "async-trait",
  "base64",
@@ -106,7 +106,7 @@ dependencies = [
 [[package]]
 name = "busbar-plugin-loader"
 version = "1.5.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=179abf2c10cf1406778300ef1f1b3964cc229727#179abf2c10cf1406778300ef1f1b3964cc229727"
+source = "git+https://github.com/GetBusbar/busbar?rev=68df8203a98da0c71ec6049bbe92fc83fde25ae6#68df8203a98da0c71ec6049bbe92fc83fde25ae6"
 dependencies = [
  "busbar-contract",
  "ed25519-dalek",
diff --git a/Cargo.toml b/Cargo.toml
index ac0a85c..84d642a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,8 +10,8 @@
 # `.busbar-ref`; no sibling-checkout path dependency ships in any manifest.
 #
 # THIRD-PARTY VERSIONS ARE THE FLEET'S, NOT THIS REPO'S. The table below is busbar's own root
-# `[workspace.dependencies]` (third-party rows) at busbar 179abf2c10cf1406778300ef1f1b3964cc229727, followed by the plugin-only rows
-# of busbar's `.github/fleet/deps.toml` at 179abf2c10cf1406778300ef1f1b3964cc229727. A member takes a crate with
+# `[workspace.dependencies]` (third-party rows) at busbar 68df8203a98da0c71ec6049bbe92fc83fde25ae6, followed by the plugin-only rows
+# of busbar's `.github/fleet/deps.toml` at 68df8203a98da0c71ec6049bbe92fc83fde25ae6. A member takes a crate with
 # `{ workspace = true }` (adding features if it needs them); a crate in neither table is a new
 # `deps.toml` row in busbar first. CI holds this repo's Cargo.lock to busbar's lock at the pin.
 [workspace]
@@ -29,16 +29,15 @@ publish = false
 repository = "https://github.com/GetBusbar/busbar-auth-github"
 
 [workspace.dependencies]
-busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "179abf2c10cf1406778300ef1f1b3964cc229727" }
-busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "179abf2c10cf1406778300ef1f1b3964cc229727" }
+busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "68df8203a98da0c71ec6049bbe92fc83fde25ae6" }
+busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "68df8203a98da0c71ec6049bbe92fc83fde25ae6" }
 # THE SUITE'S HOST CONNECTOR (dev-only; auth-github-plugin/tests/support/conformance_host.rs,
 # rendered because the declares file states network needs): busbar's connector and its TLS
 # test kit at the pin, and the transport framers those needs name, at the revs busbar links.
-busbar-core-connector = { git = "https://github.com/GetBusbar/busbar", rev = "179abf2c10cf1406778300ef1f1b3964cc229727", features = ["test-support"] }
-busbar-transport-http = { git = "https://github.com/GetBusbar/busbar-transport-http", rev = "af1a352e7df829e3a4b42539f0cb02ca77639d70" }
-busbar-transport-tcp = { git = "https://github.com/GetBusbar/busbar-transport-tcp", rev = "9cb4a0dd92a4a03622754a112b74746114e2126a" }
-# busbar's root [workspace.dependencies], third-party rows, at 179abf2c10cf1406778300ef1f1b3964cc229727
-aes = { version = "0.8", default-features = false }
+busbar-core-connector = { git = "https://github.com/GetBusbar/busbar", rev = "68df8203a98da0c71ec6049bbe92fc83fde25ae6", features = ["test-support"] }
+busbar-transport-http = { git = "https://github.com/GetBusbar/busbar-transport-http", rev = "a220d8732cb57fd39f8ec102bb692998f813bb87" }
+busbar-transport-tcp = { git = "https://github.com/GetBusbar/busbar-transport-tcp", rev = "e5014aef4f1cff11901843ddf4cf7a2910585ac6" }
+# busbar's root [workspace.dependencies], third-party rows, at 68df8203a98da0c71ec6049bbe92fc83fde25ae6
 arc-swap = "1"
 async-trait = "0.1"
 axum = "0.8"
@@ -74,13 +73,9 @@ metrics-exporter-prometheus = { version = "0.18.3", default-features = false }
 metrics-util = { version = "0.20.4", default-features = false }
 oauth-as = { version = "1.0.0", features = ["http", "jwt", "consent", "resource-metadata", "par", "dpop", "client-assertion"] }
 opentelemetry-proto = { version = "0.32", default-features = false, features = ["gen-tonic-messages", "trace"] }
-pbjson = "0.9"
-pbjson-build = "0.9"
 proc-macro2 = { version = "1", features = ["span-locations"] }
 proptest = "1"
 prost = { version = "0.14", default-features = false, features = ["std"] }
-prost-build = "0.14"
-protoc-bin-vendored = "3"
 rcgen = { version = "0.14", default-features = false, features = ["crypto", "ring"] }
 reqwest = { version = "0.12", default-features = false, features = ["rustls-tls", "stream"] }
 ring = "0.17"
@@ -95,7 +90,6 @@ sha2 = "0.10"
 smallvec = "1"
 socket2 = { version = "0.6", features = ["all"] }
 sonic-rs = "0.5"
-str0m = { version = "=0.24.1", default-features = false }
 syn = { version = "2", features = ["full", "visit", "parsing", "printing"] }
 tar = { version = "0.4", default-features = false }
 tikv-jemalloc-ctl = "0.6"
@@ -114,15 +108,19 @@ url = "2"
 webpki = { package = "rustls-webpki", version = "0.103", default-features = false, features = ["std", "ring"] }
 webpki-roots = "1"
 zeroize = "1"
-# busbar .github/fleet/deps.toml [plugin-deps], at 179abf2c10cf1406778300ef1f1b3964cc229727
+# busbar .github/fleet/deps.toml [plugin-deps], at 68df8203a98da0c71ec6049bbe92fc83fde25ae6
 fallible-iterator = "0.2"
 ldap3 = { version = "0.12", default-features = false, features = ["sync"] }
 mysql = { version = "28", default-features = false, features = ["minimal-rust"] }
 mysql_common = { version = "0.35", default-features = false }
+pbjson = "0.9"
+pbjson-build = "0.9"
 percent-encoding = "2"
 postgres = "0.19"
 postgres-protocol = "0.6.11"
 postgres-types = "0.2"
+prost-build = "0.14"
+protoc-bin-vendored = "3"
 redis = { version = "1", default-features = false, features = ["script"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
 ulid = "1"
@@ -132,4 +130,4 @@ ulid = "1"
 # patches them to its own tree. The source is busbar spelled through www.github.com: Cargo
 # refuses a patch that names the source it patches.
 [patch."https://github.com/GetBusbar/busbar"]
-busbar-contract = { git = "https://www.github.com/GetBusbar/busbar", rev = "179abf2c10cf1406778300ef1f1b3964cc229727" }
+busbar-contract = { git = "https://www.github.com/GetBusbar/busbar", rev = "68df8203a98da0c71ec6049bbe92fc83fde25ae6" }
diff --git a/deny.toml b/deny.toml
index 734386a..35eb62f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,5 +1,5 @@
 # RENDERED by `busbar-release plugin heal` from GetBusbar/busbar-release template/ and busbar's
-# `.github/fleet/deps.toml` at 179abf2c10cf1406778300ef1f1b3964cc229727; a hand edit is overwritten by the next sync. CI runs
+# `.github/fleet/deps.toml` at 68df8203a98da0c71ec6049bbe92fc83fde25ae6; a hand edit is overwritten by the next sync. CI runs
 # `cargo deny check` on it (busbar's plugin-ci.yml at the pin). The license allowlist is busbar's own;
 # the one reviewed git source is busbar itself, at the pin.
 [graph]
@@ -61,8 +61,6 @@ deny = [
     { crate = "rustls:<0.23", reason = "one rustls major (0.23) fleet-wide" },
     { crate = "ring:<0.17", reason = "one ring major (0.17) fleet-wide" },
     { crate = "serde_yaml", reason = "unmaintained; busbar uses serde_yaml_ng" },
-    { crate = "aes:<0.8.0", reason = "busbar resolves aes to 0.8.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "aes:>=0.9.0", reason = "busbar resolves aes to 0.8.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "arc-swap:<1.0.0", reason = "busbar resolves arc-swap to 1.9.2; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "arc-swap:>=2.0.0", reason = "busbar resolves arc-swap to 1.9.2; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "async-trait:<0.1.0", reason = "busbar resolves async-trait to 0.1.92; a plugin may not pull a second version (OWNER 2026-10-02)" },
@@ -133,20 +131,12 @@ deny = [
     { crate = "oauth-as:>=2.0.0", reason = "busbar resolves oauth-as to 1.0.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "opentelemetry-proto:<0.32.0", reason = "busbar resolves opentelemetry-proto to 0.32.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "opentelemetry-proto:>=0.33.0", reason = "busbar resolves opentelemetry-proto to 0.32.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "pbjson:<0.9.0", reason = "busbar resolves pbjson to 0.9.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "pbjson:>=0.10.0", reason = "busbar resolves pbjson to 0.9.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "pbjson-build:<0.9.0", reason = "busbar resolves pbjson-build to 0.9.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "pbjson-build:>=0.10.0", reason = "busbar resolves pbjson-build to 0.9.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "proc-macro2:<1.0.0", reason = "busbar resolves proc-macro2 to 1.0.106; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "proc-macro2:>=2.0.0", reason = "busbar resolves proc-macro2 to 1.0.106; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "proptest:<1.0.0", reason = "busbar resolves proptest to 1.11.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "proptest:>=2.0.0", reason = "busbar resolves proptest to 1.11.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "prost:<0.14.0", reason = "busbar resolves prost to 0.14.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "prost:>=0.15.0", reason = "busbar resolves prost to 0.14.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "prost-build:<0.14.0", reason = "busbar resolves prost-build to 0.14.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "prost-build:>=0.15.0", reason = "busbar resolves prost-build to 0.14.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "protoc-bin-vendored:<3.0.0", reason = "busbar resolves protoc-bin-vendored to 3.2.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "protoc-bin-vendored:>=4.0.0", reason = "busbar resolves protoc-bin-vendored to 3.2.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "rcgen:<0.14.0", reason = "busbar resolves rcgen to 0.14.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "rcgen:>=0.15.0", reason = "busbar resolves rcgen to 0.14.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "reqwest:<0.12.0", reason = "busbar resolves reqwest to 0.12.28; a plugin may not pull a second version (OWNER 2026-10-02)" },
@@ -175,8 +165,6 @@ deny = [
     { crate = "socket2:>=0.7.0", reason = "busbar resolves socket2 to 0.6.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "sonic-rs:<0.5.0", reason = "busbar resolves sonic-rs to 0.5.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "sonic-rs:>=0.6.0", reason = "busbar resolves sonic-rs to 0.5.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "str0m:<0.24.0", reason = "busbar resolves str0m to 0.24.1; a plugin may not pull a second version (OWNER 2026-10-02)" },
-    { crate = "str0m:>=0.25.0", reason = "busbar resolves str0m to 0.24.1; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "syn:<2.0.0", reason = "busbar resolves syn to 2.0.117, 3.0.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "syn:>=4.0.0", reason = "busbar resolves syn to 2.0.117, 3.0.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "tar:<0.4.0", reason = "busbar resolves tar to 0.4.46; a plugin may not pull a second version (OWNER 2026-10-02)" },