diff --git a/.tool-versions b/.tool-versions
index 758146800..1f933d9f6 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,5 +1,5 @@
-fastly 15.1.0
-rust 1.95.0
-nodejs 24.12.0
-viceroy 0.17.0
-wasmtime 44.0.1
+fastly 16.0.0
+rust 1.98.1
+nodejs 24.20.0
+viceroy 0.21.0
+wasmtime 48.0.1
diff --git a/AGENTS.md b/AGENTS.md
index 3b7189204..5f05818ea 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,12 +33,12 @@ Supporting files: `edgezero.toml`, `fastly.toml`,
 
 | Tool        | Version / Target                         |
 | ----------- | ---------------------------------------- |
-| Rust        | 1.95.0 (pinned in `rust-toolchain.toml`) |
+| Rust        | 1.98.1 (pinned in `rust-toolchain.toml`) |
 | WASM target | `wasm32-wasip1`                          |
-| Node        | 24.12.0 (from `.tool-versions`)          |
-| Fastly CLI  | 15.1.0 (from `.tool-versions`)           |
-| Viceroy     | 0.17.0 (from `.tool-versions`)           |
-| Wasmtime    | 44.0.1 (from `.tool-versions`)           |
+| Node        | 24.20.0 (from `.tool-versions`)          |
+| Fastly CLI  | 16.0.0 (from `.tool-versions`)           |
+| Viceroy     | 0.21.0 (from `.tool-versions`)           |
+| Wasmtime    | 48.0.1 (from `.tool-versions`)           |
 
 ---
 
@@ -142,7 +142,7 @@ cd crates/trusted-server-js/lib && node build-all.mjs
 ### Install prerequisites
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
@@ -329,7 +329,7 @@ IntegrationRegistration::builder(ID)
 | `fastly.toml`                   | Fastly service configuration and build settings                 |
 | `trusted-server.example.toml`   | Source-controlled Trusted Server app-config template            |
 | `trusted-server.toml`           | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
-| `rust-toolchain.toml`           | Pins Rust version to 1.95.0                                     |
+| `rust-toolchain.toml`           | Pins Rust version to 1.98.1                                     |
 | `.env.dev`                      | Local development environment variables                         |
 
 ---
diff --git a/Cargo.lock b/Cargo.lock
index 311597aae..5d6e3a41d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,24 +10,12 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
+ "crypto-common 0.2.2",
+ "inout",
 ]
 
 [[package]]
@@ -356,6 +344,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -410,6 +404,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bollard"
 version = "0.19.4"
@@ -517,6 +520,16 @@ dependencies = [
  "tinyvec",
 ]
 
+[[package]]
+name = "bstr"
+version = "1.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6bb31b46c14244e20ee9984b11bf5c992b91fb6939fea616e3512c8baecdbe5f"
+dependencies = [
+ "memchr",
+ "serde_core",
+]
+
 [[package]]
 name = "build-print"
 version = "1.0.1"
@@ -574,17 +587,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "chacha20"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -592,21 +594,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "chacha20poly1305"
-version = "0.10.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
 dependencies = [
  "aead",
- "chacha20 0.9.1",
+ "chacha20",
  "cipher",
  "poly1305",
- "zeroize",
 ]
 
 [[package]]
@@ -717,13 +719,13 @@ dependencies = [
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common",
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
  "inout",
- "zeroize",
 ]
 
 [[package]]
@@ -775,6 +777,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -844,6 +852,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -1013,10 +1027,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "getrandom 0.4.3",
+ "hybrid-array",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.35.0"
@@ -1063,6 +1087,15 @@ dependencies = [
  "linktime-proc-macro",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -1203,7 +1236,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "zeroize",
 ]
 
@@ -1300,9 +1333,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
- "crypto-common",
- "subtle",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1427,7 +1471,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "toml",
 ]
@@ -1435,7 +1479,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-axum"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1463,7 +1507,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-cloudflare"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1486,11 +1530,12 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-fastly"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "brotli",
  "bytes",
  "chrono",
@@ -1506,7 +1551,7 @@ dependencies = [
  "log-fastly",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror 2.0.18",
  "toml_edit 0.25.12+spec-1.1.0",
  "walkdir",
@@ -1515,7 +1560,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-spin"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1542,7 +1587,7 @@ dependencies = [
 [[package]]
 name = "edgezero-cli"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "chrono",
  "clap",
@@ -1567,12 +1612,13 @@ dependencies = [
 [[package]]
 name = "edgezero-core"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "anyhow",
  "async-compression",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "bytes",
  "edgezero-macros",
  "futures",
@@ -1586,7 +1632,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror 2.0.18",
  "toml",
  "tower-service",
@@ -1598,7 +1644,7 @@ dependencies = [
 [[package]]
 name = "edgezero-macros"
 version = "0.1.0"
-source = "git+https://github.com/stackpop/edgezero?tag=v0.0.8#567964158e4f8bd0d52321b9801de44966422e1b"
+source = "git+https://github.com/stackpop/edgezero?rev=9ba4eae7b2146e1224658c3b0342ff75a2bc0265#9ba4eae7b2146e1224658c3b0342ff75a2bc0265"
 dependencies = [
  "log",
  "proc-macro2",
@@ -1628,7 +1674,7 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
@@ -1722,8 +1768,7 @@ dependencies = [
 [[package]]
 name = "esi"
 version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "026264c3022569f7bc5052f9452362537e923b34ecc9248b803437c2b89cdd81"
+source = "git+https://github.com/stackpop/esi?rev=75bfbb396#75bfbb396d4cb7792610f1287cbec61675f13f38"
 dependencies = [
  "atoi",
  "base64",
@@ -1765,9 +1810,9 @@ checksum = "7360491ce676a36bf9bb3c56c1aa791658183a54d2744120f27285738d90465a"
 
 [[package]]
 name = "fastly"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531e4c3df48350d9f4fc95b4deaf87fd29820336b7926bb84bf460457c2a126b"
+checksum = "3c5c07c0c67d0b5826d1cb2311e563a17860b50e2ae89e1c703d6400d904d1e2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1778,7 +1823,6 @@ dependencies = [
  "fastly-sys",
  "http",
  "itertools 0.13.0",
- "lazy_static",
  "mime",
  "serde",
  "serde_json",
@@ -1793,9 +1837,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-macros"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2aef5f9690b04c8890f9a54ddb591b12b9779ec25ee0e572d207106e52e3d8"
+checksum = "698025eab5612adab20df48963a5126650893014e8505af02a0af20939ee6a05"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1804,9 +1848,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-shared"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "080ad138403159fd366d3e0b14bb49cb0c01dc18c25095bbbd1c85e3338f5413"
+checksum = "191c2cf082f5d17f4ca0685cedaa0642ad4ade949fac8d1dbdd62ff756b13500"
 dependencies = [
  "bitflags 1.3.2",
  "http",
@@ -1814,9 +1858,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-sys"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de75ef193f6c29c43d667458bede648970715aedd5db2d42c2eba3ffa3ad738b"
+checksum = "239c77706cf9110b423a89b6b03b8011729b144390d2a7f641d95ef66b2768b8"
 dependencies = [
  "bitflags 1.3.2",
  "fastly-shared",
@@ -2082,9 +2126,11 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
+ "js-sys",
  "libc",
  "r-efi 6.0.0",
  "rand_core 0.10.1",
+ "wasm-bindgen",
 ]
 
 [[package]]
@@ -2161,9 +2207,6 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
 
 [[package]]
 name = "hashbrown"
@@ -2185,15 +2228,6 @@ dependencies = [
  "foldhash",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.11.1"
@@ -2223,11 +2257,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -2301,6 +2335,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -2601,11 +2644,11 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "4250ce6452e92010fdf7268ccc5d14faa80bb12fc741938534c58f16804e03c7"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -2835,9 +2878,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -2891,9 +2934,9 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "log-fastly"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51dae5def13a2d557fdb63862d642f8d4641ec3773c036bb14092697b6764013"
+checksum = "433713b6191ad3e1d5248db9536f3e2d99a12d7ff998afd272a98d96e6dbc2ed"
 dependencies = [
  "fastly",
  "log",
@@ -3545,12 +3588,11 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "poly1305"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
 dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
+ "cpufeatures 0.3.0",
  "universal-hash",
 ]
 
@@ -3676,7 +3718,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "be769465445e8c1474e9c5dac2018218498557af32d9ed057325ec9a41ae81bf"
 dependencies = [
  "heck",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "log",
  "multimap",
  "once_cell",
@@ -3696,7 +3738,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8a56d757972c98b346a9b766e3f02746cde6dd1cd1d1d563472929fdd74bec4d"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -3709,7 +3751,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b570b25f7617e43d59005d0990ccb79e950a423952cea19671b7a876da390adf"
 dependencies = [
  "anyhow",
- "itertools 0.10.5",
+ "itertools 0.13.0",
  "proc-macro2",
  "quote",
  "syn 2.0.118",
@@ -3853,7 +3895,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
@@ -3918,9 +3960,9 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "4.1.0"
+version = "4.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e925444704b5f17d32bf42f5b6e2df050bceebc3dcd6e71cc73dafe8092e839"
+checksum = "de6c3b63e007e90ce536ec2ae4690826136a20ec8dbbbb400daef1bb999d2e36"
 dependencies = [
  "libc",
 ]
@@ -4109,7 +4151,7 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
@@ -4125,14 +4167,13 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.0",
  "fallible-iterator",
  "fallible-streaming-iterator",
- "hashlink 0.9.1",
  "libsqlite3-sys",
  "smallvec",
 ]
@@ -4351,7 +4392,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "der",
  "generic-array",
  "subtle",
@@ -4611,6 +4652,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "shlex"
 version = "2.0.1"
@@ -4661,9 +4713,12 @@ checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "similar"
-version = "2.7.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
+checksum = "4f66ca1f7aca2474dc10c942eb22feffc897735f54cd1db90138c2fddb490987"
+dependencies = [
+ "bstr",
+]
 
 [[package]]
 name = "simple_logger"
@@ -4713,9 +4768,9 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "spin-macro"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11e483b94d5bcfac493caf0427fa875063e3e8604d0466a4ab491ec200a42857"
+checksum = "ac8a641da857d4e7cada31a853c40180eeb10485a0f2f0282d0a7e5a2a4105d4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4724,9 +4779,9 @@ dependencies = [
 
 [[package]]
 name = "spin-sdk"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fd2abac3eb2ee249c2241ab87f7b1287f36172c8cc1ea815c19c85e41ede44d"
+checksum = "2b7a3d9a6805ccdb4d404e91ccf7198ac5e486b6199dc9387aeebaa368272112"
 dependencies = [
  "anyhow",
  "bytes",
@@ -5486,6 +5541,7 @@ dependencies = [
  "flate2",
  "futures",
  "getrandom 0.2.17",
+ "getrandom 0.4.3",
  "glob",
  "hex",
  "hmac",
@@ -5501,7 +5557,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "subtle",
  "temp-env",
  "tokio",
@@ -5550,7 +5606,7 @@ version = "0.1.0"
 dependencies = [
  "build-print",
  "hex",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "which",
 ]
 
@@ -5647,12 +5703,12 @@ checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
- "crypto-common",
- "subtle",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -5744,12 +5800,11 @@ dependencies = [
 
 [[package]]
 name = "validator"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43fb22e1a008ece370ce08a3e9e4447a910e92621bb49b85d6e48a45397e7cfa"
+checksum = "c3d68c6633c483df6780cc5277a417c7c2d1bceee2649d06c8ab6b0fd2dd3c81"
 dependencies = [
  "idna",
- "once_cell",
  "regex",
  "serde",
  "serde_derive",
@@ -5820,9 +5875,9 @@ dependencies = [
 
 [[package]]
 name = "wasip3"
-version = "0.6.0+wasi-0.3.0-rc-2026-03-15"
+version = "0.7.1+wasi-0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed83456dd6a0b8581998c0365e4651fa2997e5093b49243b7f35391afaa7a3d9"
+checksum = "75e9ed91ee5a995b6fe16c89d4511a8c12eb76967be20b57557618e02e781bcc"
 dependencies = [
  "bytes",
  "http",
@@ -6469,7 +6524,7 @@ checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
 dependencies = [
  "arraydeque",
  "encoding_rs",
- "hashlink 0.11.1",
+ "hashlink",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index dfd94d0c4..88ce3a654 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,7 @@ base64 = "0.22"
 brotli = "8.0"
 build-print = "1.0.1"
 bytes = "1.11"
-chacha20poly1305 = "0.10"
+chacha20poly1305 = "0.11"
 chrono = "0.4.44"
 chromiumoxide = "0.9.1"
 clap = { version = "4", features = ["derive"] }
@@ -55,23 +55,34 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8", default-features = false }
-edgezero-cli = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8" }
-edgezero-core = { git = "https://github.com/stackpop/edgezero", tag = "v0.0.8", default-features = false }
+# Pinned to the head of edgezero PR #366 (Rust 1.98.1, fastly 0.13,
+# spin-sdk ~7, validator 0.21, sha2 0.11) rather than a tag. The newest
+# release, v0.0.8, is what `main` pins, but it still carries fastly 0.12,
+# sha2 0.10, spin-sdk ~6.0 and validator 0.20, so resolving this conflict
+# in its favour would undo every major below. Move back to a tag once
+# #366 merges and is tagged.
+edgezero-adapter-axum = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265", default-features = false }
+edgezero-cli = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265" }
+edgezero-core = { git = "https://github.com/stackpop/edgezero", rev = "9ba4eae7b2146e1224658c3b0342ff75a2bc0265", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
-fastly = "0.12"
+fastly = "0.13"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
 glob = "0.3"
 getrandom = "0.2"
+# `sha2` 0.11 pulls `crypto-common` 0.2, which depends on getrandom 0.4.
+# Both lines coexist in the graph; 0.4 renamed the browser RNG feature
+# from `js` to `wasm_js`, so it needs its own pin to enable it on
+# `wasm32-unknown-unknown`.
+getrandom_04 = { package = "getrandom", version = "0.4" }
 hex = "0.4.3"
-hmac = "0.12.1"
+hmac = "0.13"
 http = "1.4.0"
 httpdate = "1.0.3"
 http-body-util = "0.1"
@@ -82,7 +93,7 @@ jose-jwk = "0.1.2"
 js-sys = "0.3"
 libc = "0.2"
 log = "0.4.29"
-log-fastly = "0.12"
+log-fastly = "0.13"
 lol_html = "2.7.2"
 matchit = "0.9"
 mime = "0.3"
@@ -96,9 +107,9 @@ rustls-pemfile = "2"
 scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.149"
-sha2 = "0.10.9"
+sha2 = "0.11"
 simple_logger = "5"
-spin-sdk = { version = "~6.0", default-features = false, features = ["http", "key-value", "variables"] }
+spin-sdk = { version = "~7.0", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
 temp-env = "0.3.6"
 tempfile = "3.24"
@@ -115,13 +126,20 @@ trusted-server-openrtb = { path = "crates/trusted-server-openrtb" }
 url = "2.5.8"
 urlencoding = "2.1"
 uuid = { version = "1.18", features = ["v4"] }
-validator = { version = "0.20", features = ["derive"] }
+validator = { version = "0.21", features = ["derive"] }
 web-time = "1"
 webpki-roots = "1"
 which = "8"
 worker = { version = "0.8", default-features = false, features = ["http"] }
 x509-parser = "0.16"
 
+# `esi` 0.7.2 pins `fastly = "^0.12"` while EdgeZero requires 0.13, and both
+# meet in `trusted-server-adapter-fastly`. The fork carries the range bump
+# and no source change (stackpop/esi@chore/fastly-0.13); drop this patch
+# once the fix is released upstream. See issue #1122.
+[patch.crates-io]
+esi = { git = "https://github.com/stackpop/esi", rev = "75bfbb396" }
+
 [workspace.lints.clippy]
 # Correctness - Force explicit error handling in production code
 unwrap_used = "deny"
diff --git a/crates/trusted-server-cli/src/run.rs b/crates/trusted-server-cli/src/run.rs
index 13009d448..657de36c1 100644
--- a/crates/trusted-server-cli/src/run.rs
+++ b/crates/trusted-server-cli/src/run.rs
@@ -134,7 +134,6 @@ fn dispatch(args: Args) -> Result<(), String> {
 mod tests {
     use std::path::PathBuf;
 
-    use clap::Parser as _;
     use edgezero_cli::args::{AuthSub, ConfigDiffArgs, ConfigPushArgs, ConfigValidateArgs};
 
     use super::*;
diff --git a/crates/trusted-server-core/Cargo.toml b/crates/trusted-server-core/Cargo.toml
index 01780dd39..a2b9268fa 100644
--- a/crates/trusted-server-core/Cargo.toml
+++ b/crates/trusted-server-core/Cargo.toml
@@ -57,6 +57,7 @@ web-time = { workspace = true }
 # The Fastly adapter uses `wasm32-wasip1`, which has native POSIX RNG and does not
 # need these — this block is intentionally scoped to `target_os = "unknown"` only.
 getrandom = { workspace = true, features = ["js"] }
+getrandom_04 = { workspace = true, features = ["wasm_js"] }
 uuid = { workspace = true, features = ["js"] }
 
 [features]
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 2924b7692..6b9ed2716 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -6,7 +6,7 @@
 use std::net::IpAddr;
 
 use error_stack::{Report, ResultExt};
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit as _, Mac};
 use rand::Rng;
 use sha2::Sha256;
 
diff --git a/crates/trusted-server-core/src/http_util.rs b/crates/trusted-server-core/src/http_util.rs
index 457e50356..e12eefdbb 100644
--- a/crates/trusted-server-core/src/http_util.rs
+++ b/crates/trusted-server-core/src/http_util.rs
@@ -359,15 +359,15 @@ pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
     let nonce_full = hasher.finalize();
     let mut nonce = [0_u8; 24];
     nonce[..24].copy_from_slice(&nonce_full[..24]);
-    let nonce = XNonce::from_slice(&nonce);
+    let nonce = XNonce::from(nonce);
 
     let ciphertext = cipher
-        .encrypt(nonce, plaintext_url.as_bytes())
+        .encrypt(&nonce, plaintext_url.as_bytes())
         .expect("encryption failure");
 
     let mut out: Vec<u8> = Vec::with_capacity(2 + 24 + ciphertext.len());
     out.extend_from_slice(b"x1");
-    out.extend_from_slice(nonce);
+    out.extend_from_slice(&nonce);
     out.extend_from_slice(&ciphertext);
     URL_SAFE_NO_PAD.encode(out)
 }
@@ -383,12 +383,12 @@ pub fn decode_url(settings: &Settings, token: &str) -> Option<String> {
         return None;
     }
     let nonce_bytes = &data[2..2 + 24];
-    let nonce = XNonce::from_slice(nonce_bytes);
+    let nonce = XNonce::try_from(nonce_bytes).ok()?;
     let ciphertext = &data[2 + 24..];
 
     let key_bytes = Sha256::digest(settings.publisher.proxy_secret.expose().as_bytes());
     let cipher = XChaCha20Poly1305::new(&key_bytes);
-    let pt = cipher.decrypt(nonce, ciphertext).ok()?;
+    let pt = cipher.decrypt(&nonce, ciphertext).ok()?;
     String::from_utf8(pt).ok()
 }
 
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 05daf0b4e..e37abc5a1 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -6801,7 +6801,7 @@ fn mark_deprecated_alias(response: &mut Response<EdgeBody>, is_legacy_alias: boo
 #[cfg(test)]
 mod tests {
     use std::future::Future as _;
-    use std::io::{self, Read as _, Write as _};
+    use std::io::{self, Read as _};
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     use brotli::Decompressor;
diff --git a/crates/trusted-server-core/src/s3_sigv4.rs b/crates/trusted-server-core/src/s3_sigv4.rs
index 1a862882e..dc4dc25ad 100644
--- a/crates/trusted-server-core/src/s3_sigv4.rs
+++ b/crates/trusted-server-core/src/s3_sigv4.rs
@@ -14,7 +14,7 @@ use std::time::SystemTime;
 
 use chrono::{DateTime, Utc};
 use error_stack::Report;
-use hmac::{Hmac, Mac as _};
+use hmac::{Hmac, KeyInit as _, Mac as _};
 use http::{HeaderMap, HeaderValue, Method, header};
 use sha2::{Digest as _, Sha256};
 use url::Url;
diff --git a/crates/trusted-server-core/src/settings_data.rs b/crates/trusted-server-core/src/settings_data.rs
index 103ac819c..38e1db9ee 100644
--- a/crates/trusted-server-core/src/settings_data.rs
+++ b/crates/trusted-server-core/src/settings_data.rs
@@ -188,7 +188,7 @@ fn resolve_fastly_chunk_pointer(
 }
 
 fn sha256_hex(bytes: &[u8]) -> String {
-    format!("{:x}", Sha256::digest(bytes))
+    hex::encode(Sha256::digest(bytes))
 }
 
 fn configuration_error<T>(message: String) -> Result<T, Report<TrustedServerError>> {
diff --git a/crates/trusted-server-integration-tests/README.md b/crates/trusted-server-integration-tests/README.md
index e82cb8837..4edc569f5 100644
--- a/crates/trusted-server-integration-tests/README.md
+++ b/crates/trusted-server-integration-tests/README.md
@@ -7,7 +7,7 @@ containers using [Testcontainers](https://testcontainers.com/) and
 ## Prerequisites
 
 - **Docker** — running and accessible
-- **Viceroy** — Fastly local simulator (`cargo install viceroy --version 0.17.0 --locked --force`)
+- **Viceroy** — Fastly local simulator (`cargo install viceroy --version 0.21.0 --locked --force`)
 - **wasm32-wasip1 target** — `rustup target add wasm32-wasip1`
 - **Node.js** — version pinned in `.tool-versions`, for browser tests only
 
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index 0f7fd26bc..d1fde9071 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -633,7 +633,7 @@ Warning: viceroy version mismatch
 **Solution:**
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index f70cd25b8..e1c5ec3a7 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -50,7 +50,7 @@ Simulates the full Fastly production environment locally.
 Install and configure the Fastly CLI using the [Fastly setup guide](/guide/fastly), then install Viceroy:
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 Create and push the starter config, then start the local Fastly simulator:
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index e1751bc49..2bb038815 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -10,7 +10,7 @@ Viceroy is the local test runtime for Fastly Compute applications. It simulates
 
 ```bash
 # Install viceroy
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 
 # Run Fastly/WASM crate tests (viceroy is invoked automatically via .cargo/config.toml runner)
 cargo test-fastly
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e72500aa1..b21f5b55e 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.95.0"
+channel = "1.98.1"
 targets = [ "wasm32-wasip1", "wasm32-unknown-unknown" ]
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index 714de510b..b8995b16a 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #   - Node.js with npx available
 #
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 96e492f40..207155996 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #
 set -euo pipefail
diff --git a/scripts/template-cache-local-test.sh b/scripts/template-cache-local-test.sh
index 58d714cf8..92e279941 100755
--- a/scripts/template-cache-local-test.sh
+++ b/scripts/template-cache-local-test.sh
@@ -63,7 +63,7 @@ cleanup() {
 trap cleanup EXIT INT TERM
 
 command -v viceroy >/dev/null || {
-  echo "viceroy not found. Install: cargo install viceroy --version 0.17.0 --locked" >&2
+  echo "viceroy not found. Install: cargo install viceroy --version 0.21.0 --locked" >&2
   exit 1
 }
 command -v node >/dev/null || {