diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ebc7c84e3..9cccbe6bd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1035,7 +1035,7 @@ jobs:
           setup-gradle: "false"
 
       - name: Install cargo-bloat
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-bloat
 
@@ -1106,7 +1106,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-deny@0.19.8
 
@@ -1130,7 +1130,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install cargo-deny
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-deny@0.19.8
 
@@ -1162,7 +1162,7 @@ jobs:
           shared-key: diagnostics-probes-facade
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
 
@@ -1206,7 +1206,7 @@ jobs:
           shared-key: rust-host
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
 
@@ -1270,12 +1270,12 @@ jobs:
           shared-key: rust-host
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
-      - uses: mozilla-actions/sccache-action@9e7fa8a12102821edf02ca5dbea1acd0f89a2696 # v0.0.10
+      - uses: mozilla-actions/sccache-action@fc920bf0ec8de6ee65d409111f7ec508035751ba # v0.0.11
         env:
           FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-nextest
 
@@ -1322,7 +1322,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-fuzz
 
@@ -1353,7 +1353,7 @@ jobs:
       - name: Install rustdoc JSON toolchain for cargo-public-api
         run: rustup toolchain install nightly --profile minimal --no-self-update
       - name: Install cargo-public-api
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-public-api@0.52.0
       - name: Check Rust public API snapshots
@@ -1437,7 +1437,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-nextest
 
@@ -1467,7 +1467,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-nextest
 
@@ -1532,7 +1532,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
 
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-nextest
 
@@ -1624,7 +1624,7 @@ jobs:
           setup-sccache: "false"
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-llvm-cov
 
@@ -2285,7 +2285,7 @@ jobs:
           setup-sccache: "false"
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-llvm-cov
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5f7267ddd..a3adcf462 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -48,6 +48,6 @@ jobs:
       # Restore JDK/Android SDK setup and compileDebugKotlin when re-enabling.
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/fuzz-nightly.yml b/.github/workflows/fuzz-nightly.yml
index 6059f29ce..dc6c7f214 100644
--- a/.github/workflows/fuzz-nightly.yml
+++ b/.github/workflows/fuzz-nightly.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           toolchain: nightly-2026-06-12
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+        uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-fuzz@0.13.1
       - name: Run fuzz targets
diff --git a/.github/workflows/jni-symbol-diff.yml b/.github/workflows/jni-symbol-diff.yml
index 7ef53c75d..f37062baa 100644
--- a/.github/workflows/jni-symbol-diff.yml
+++ b/.github/workflows/jni-symbol-diff.yml
@@ -21,34 +21,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Set up JDK
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: ./.github/actions/setup-android-rust
         with:
-          distribution: temurin
-          java-version: "17"
-
-      - name: Set up Android SDK
-        uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
-
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
-        with:
-          toolchain: stable
-          targets: aarch64-linux-android,armv7-linux-androideabi,x86_64-linux-android,i686-linux-android
-
-      - name: Install Android NDK
-        run: |
-          sdkmanager "ndk;27.2.12479018"
-          echo "ANDROID_NDK_HOME=${ANDROID_SDK_ROOT}/ndk/27.2.12479018" >> "${GITHUB_ENV}"
-
-      - name: Cache Rust build
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            native/rust/target
-          key: jni-sym-${{ runner.os }}-${{ hashFiles('native/rust/Cargo.lock') }}
-          restore-keys: jni-sym-${{ runner.os }}-
+          rust-components: ""
+          rust-cache-shared-key: jni-sym
+          gradle-cache-read-only: "true"
 
       # Materialize the pinned rust-toolchain.toml channel + its components
       # (clippy/rust-src/rust-analyzer/rustfmt) once, serially, before the
@@ -65,8 +42,6 @@ jobs:
 
       - name: Build native library (arm64-v8a release)
         run: ./gradlew :core:engine:buildRustNativeLibs
-        env:
-          ANDROID_NDK_HOME: ${{ env.ANDROID_NDK_HOME }}
 
       - name: Locate libripdpi.so (arm64-v8a)
         id: locate
diff --git a/.github/workflows/mutation-testing.yml b/.github/workflows/mutation-testing.yml
index 3ab8cf980..a24983ca5 100644
--- a/.github/workflows/mutation-testing.yml
+++ b/.github/workflows/mutation-testing.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           toolchain: "1.96.0"
 
-      - uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf # v2.85.2
+      - uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf # v2.85.5
         with:
           tool: cargo-nextest,cargo-mutants
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2021956a3..f9eab0d8e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,7 +26,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: |
@@ -192,7 +192,7 @@ jobs:
           fi
 
       - name: Create draft GitHub Release from exact candidate bytes
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ github.ref_name }}
           draft: true
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 2d62aa96e..04368993c 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -12,7 +12,7 @@ activity-compose = "1.13.0"
 navigation-compose = "2.9.8"
 compose-bom = "2026.06.01"
 datastore = "1.2.1"
-grpc = "1.83.0"
+grpc = "1.83.1"
 protobuf = "4.35.1"
 protobuf-plugin = "0.10.0"
 coroutines = "1.11.0"
@@ -39,7 +39,7 @@ room = "2.8.4"
 robolectric = "4.16.1"
 roborazzi = "1.70.0"
 leakcanary = "2.14"
-compose-preview-plugin = "0.18.4"
+compose-preview-plugin = "0.19.12"
 module-graph = "0.13.0"
 retrofit = "3.0.0"
 okhttp = "5.4.0"
diff --git a/native/rust/Cargo.lock b/native/rust/Cargo.lock
index b20bd6620..ebe6c9e0e 100644
--- a/native/rust/Cargo.lock
+++ b/native/rust/Cargo.lock
@@ -42,9 +42,9 @@ dependencies = [
 
 [[package]]
 name = "aes"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1fc76eaeac4c9164506c466d4ffdd8ec9d0c5bf57ee97177c4d8eceb3a0e138"
+checksum = "f8eb277bec05f56a0e0591f155a484cbd0f4f07ff2905051a48c72f004f7ed58"
 dependencies = [
  "cipher 0.5.2",
  "cpubits",
@@ -73,7 +73,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fdf011db2e21ce0d575593d749db5554b47fed37aff429e4dc50bc91ac93a028"
 dependencies = [
  "aead 0.6.1",
- "aes 0.9.1",
+ "aes 0.9.2",
  "cipher 0.5.2",
  "ctr 0.10.1",
  "ghash 0.6.0",
@@ -1613,12 +1613,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba91f619216e76a5eb2515783f7ec2e271938b51aadac592f4930517f4626863"
 dependencies = [
  "heck",
- "indexmap 1.9.3",
+ "indexmap 2.14.0",
  "itertools 0.14.0",
  "proc-macro-crate",
  "proc-macro2",
  "quote",
- "sha3 0.11.0",
+ "sha3 0.12.0",
  "strum",
  "syn 3.0.3",
  "unicode-ident",
@@ -1739,7 +1739,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -2014,9 +2014,9 @@ dependencies = [
 
 [[package]]
 name = "etherparse"
-version = "0.20.3"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aeebdb565da33451794551a771bd0b4e6f416d3182adc3ed2837f614d6168f9a"
+checksum = "17304d06addb3283cdc4bd528e42dd95e73c8ee2d6492ffce415e93660885449"
 dependencies = [
  "arrayvec",
 ]
@@ -2388,7 +2388,7 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link 0.2.1",
+ "windows-link 0.1.3",
  "windows-result 0.4.1",
 ]
 
@@ -2841,9 +2841,9 @@ dependencies = [
 
 [[package]]
 name = "http"
-version = "1.4.2"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6970f50e31d6fc17d3fa27329444bfa74e196cf62e95052a3f6fee181dba6425"
+checksum = "918d3568bebf352712bc2ef3d46a8bcf1a75b373be6539de198e9105cbbf9ce0"
 dependencies = [
  "bytes",
  "itoa",
@@ -3725,9 +3725,9 @@ dependencies = [
 
 [[package]]
 name = "mio"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02bd0af71c67b473010cbbc60715ee815645a4dc942899111f494b4b737d6fda"
+checksum = "30d65c71f1ce40ab09135ce117d742b9f8a19ff91a41a8b57ed50bc2de59c427"
 dependencies = [
  "libc",
  "log",
@@ -4000,7 +4000,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4557,7 +4557,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "279a91971a1d8eb1260a30938eae3be9cb67b472dffecb222fbbbe2fd2dc1453"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "cbc",
  "der 0.8.0",
  "pbkdf2",
@@ -4823,7 +4823,7 @@ dependencies = [
  "derive-deftly",
  "libc",
  "paste",
- "thiserror 1.0.69",
+ "thiserror 2.0.19",
 ]
 
 [[package]]
@@ -4896,7 +4896,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -5490,7 +5490,7 @@ version = "0.1.0"
 name = "ripdpi-cli"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "libc",
  "local-network-fixture",
  "log",
@@ -5545,7 +5545,7 @@ dependencies = [
 name = "ripdpi-desync"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "golden-test-support",
  "linkme",
  "rand 0.10.2",
@@ -5562,7 +5562,7 @@ dependencies = [
 name = "ripdpi-desync-runtime"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "libc",
  "loom",
  "ring",
@@ -6022,7 +6022,7 @@ version = "0.1.0"
 name = "ripdpi-packets"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "enum-map",
  "nom 8.0.0",
  "proptest",
@@ -6090,7 +6090,7 @@ dependencies = [
 name = "ripdpi-proxy-runtime"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "base64 0.23.0",
  "ctr 0.10.1",
  "libc",
@@ -6354,7 +6354,7 @@ dependencies = [
 name = "ripdpi-runtime-policy"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "ring",
  "ripdpi-config",
  "ripdpi-desync",
@@ -6408,7 +6408,7 @@ dependencies = [
 name = "ripdpi-shadowsocks"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "aes-gcm 0.11.0",
  "base64 0.23.0",
  "blake3",
@@ -6772,7 +6772,7 @@ dependencies = [
 name = "ripdpi-vless"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "base64 0.23.0",
  "boring",
  "foreign-types-shared",
@@ -6899,7 +6899,7 @@ dependencies = [
 name = "ripdpi-ws-tunnel"
 version = "0.1.0"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "boring",
  "bytes",
  "cipher 0.5.2",
@@ -7020,11 +7020,11 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.62.4"
+version = "0.62.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8b67b5a0d8068c89dcbe9d95df986af7a851d1f3c604525274c37468e60464f"
+checksum = "da7c230e0ed9cbeb92fbad6c8848985d6df2a1464c0dc247a021abd666e9005e"
 dependencies = [
- "aes 0.9.1",
+ "aes 0.9.2",
  "aws-lc-rs",
  "bitflags 2.13.1",
  "block-padding",
@@ -7153,9 +7153,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.42"
+version = "0.23.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c54fcab019b409d04215d3a17cb438fd7fbf192ee61461f20f4fe18704bc138"
+checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
 dependencies = [
  "aws-lc-rs",
  "log",
@@ -7845,7 +7845,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d801accda99469cde6d73da741422610fdf6508a72d9a69d1b55cb241c720597"
 dependencies = [
  "aead 0.6.1",
- "aes 0.9.1",
+ "aes 0.9.2",
  "aes-gcm 0.11.0",
  "chacha20 0.10.0",
  "cipher 0.5.2",
@@ -8304,9 +8304,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
 dependencies = [
  "futures-util",
  "log",
@@ -8316,15 +8316,16 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.18"
+version = "0.7.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
+checksum = "494815d09bf52b5548659851081238f0ca39ff638363907596da739561c62c52"
 dependencies = [
  "bytes",
  "futures-core",
  "futures-io",
  "futures-sink",
  "futures-util",
+ "libc",
  "pin-project-lite",
  "tokio",
 ]
@@ -9649,17 +9650,17 @@ dependencies = [
 
 [[package]]
 name = "tungstenite"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
 dependencies = [
  "bytes",
  "data-encoding",
  "http",
  "httparse",
  "log",
- "rand 0.9.3",
- "sha1 0.10.6",
+ "rand 0.10.2",
+ "sha1 0.11.0",
  "thiserror 2.0.19",
 ]
 
@@ -10442,7 +10443,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
 dependencies = [
  "cfg-if",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
diff --git a/native/rust/Cargo.toml b/native/rust/Cargo.toml
index 09494e8ba..a32546419 100644
--- a/native/rust/Cargo.toml
+++ b/native/rust/Cargo.toml
@@ -230,7 +230,7 @@ ripdpi-ssh = { path = "crates/ripdpi-ssh" }
 # primitives (rsa, ssh-key, ssh-cipher) remain release candidates and ship in every
 # build via the always-on SSH relay. Track the remaining upstream stabilization in
 # deny.toml [advisories] "Known RC-crypto exposure" and Eugeny/russh #697 / PR #702.
-russh = "=0.62.4"
+russh = "=0.62.5"
 ripdpi-naiveproxy = { path = "crates/ripdpi-naiveproxy" }
 ripdpi-cloudflare-origin = { path = "crates/ripdpi-cloudflare-origin" }
 criterion = { version = "0.8", features = ["html_reports"] }
@@ -252,7 +252,7 @@ anyhow = "1"
 # features, but pin it explicitly so a future default-features purge cannot silently
 # drop DNSCrypt's classic-NaCl-box cipher path. See ripdpi-dns-resolver dnscrypt::cipher.
 crypto_box = { version = "0.9", features = ["chacha20", "salsa20"] }
-etherparse = "0.20"
+etherparse = "0.21"
 pico-args = "0.5"
 pollster = "1.0"
 hex = "0.4"
@@ -328,8 +328,8 @@ ringbuf = { version = "0.5", features = ["alloc"] }
 sha2 = "0.11"
 flate2 = "1"
 time = "0.3"
-tungstenite = { version = "0.29", default-features = false, features = ["handshake"] }
-tokio-tungstenite = { version = "0.29", default-features = false, features = ["handshake"] }
+tungstenite = { version = "0.30", default-features = false, features = ["handshake"] }
+tokio-tungstenite = { version = "0.30", default-features = false, features = ["handshake"] }
 
 [workspace.lints.clippy]
 # Correctness & suspicious (errors)
diff --git a/native/rust/crates/ripdpi-tunnel-core/src/classify.rs b/native/rust/crates/ripdpi-tunnel-core/src/classify.rs
index 9a9cc2201..4bc50da16 100644
--- a/native/rust/crates/ripdpi-tunnel-core/src/classify.rs
+++ b/native/rust/crates/ripdpi-tunnel-core/src/classify.rs
@@ -52,7 +52,9 @@ fn classify_parsed_packet<'a>(
     };
 
     let udp = match transport {
-        TransportSlice::Icmpv4(_) | TransportSlice::Icmpv6(_) => return IpClass::TcpOrOther,
+        TransportSlice::Icmpv4(_) | TransportSlice::Icmpv6(_) | TransportSlice::Igmp(_) => {
+            return IpClass::TcpOrOther;
+        }
         TransportSlice::Udp(udp) => udp,
         TransportSlice::Tcp(_) => return IpClass::TcpOrOther,
     };
@@ -136,6 +138,19 @@ mod tests {
         pkt
     }
 
+    fn ipv4_igmp() -> Vec<u8> {
+        let mut pkt = vec![0u8; 28];
+        pkt[0] = 0x45;
+        pkt[2..4].copy_from_slice(&28u16.to_be_bytes());
+        pkt[8] = 64;
+        pkt[9] = 2;
+        pkt[12..16].copy_from_slice(&[10, 0, 0, 1]);
+        pkt[16..20].copy_from_slice(&[224, 0, 0, 1]);
+        pkt[20] = 0x11;
+        pkt[21] = 0x64;
+        pkt
+    }
+
     fn ipv6_udp(src_ip: Ipv6Addr, dst_ip: Ipv6Addr, src_port: u16, dst_port: u16, payload: &[u8]) -> Vec<u8> {
         let udp_len = 8 + payload.len();
         let payload_len = udp_len as u16;
@@ -199,6 +214,13 @@ mod tests {
         assert!(matches!(class, IpClass::TcpOrOther));
     }
 
+    #[test]
+    fn igmp_is_tcp_or_other() {
+        let pkt = ipv4_igmp();
+        let class = classify_ip_packet(&pkt, None);
+        assert!(matches!(class, IpClass::TcpOrOther));
+    }
+
     #[test]
     fn wrong_port_does_not_trigger_dns_intercept() {
         let pkt = ipv4_udp([10, 0, 0, 1], [198, 18, 0, 0], 12345, 80, b"data");
diff --git a/scripts/tests/test_ci_tool_pinning.py b/scripts/tests/test_ci_tool_pinning.py
index 47d13c255..047c2e568 100644
--- a/scripts/tests/test_ci_tool_pinning.py
+++ b/scripts/tests/test_ci_tool_pinning.py
@@ -69,6 +69,14 @@ def test_android_native_toolchain_installs_pinned_cmake(self) -> None:
             action,
         )
 
+    def test_jni_symbol_guard_uses_shared_android_rust_setup(self) -> None:
+        source = (ROOT / ".github/workflows/jni-symbol-diff.yml").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertIn("uses: ./.github/actions/setup-android-rust", source)
+        self.assertNotIn('sdkmanager "ndk;', source)
+
     def test_github_actions_do_not_execute_floating_rust_toolchain_action(self) -> None:
         sources = [ROOT / ".github/actions/setup-android-rust/action.yml"]
         sources.extend(sorted((ROOT / ".github/workflows").glob("*.yml")))
@@ -81,7 +89,7 @@ def test_fuzz_nightly_uses_prebuilt_pinned_cargo_fuzz(self) -> None:
         )
 
         self.assertIn(
-            "uses: taiki-e/install-action@41049aa56687c35e0afa74eed4f09cec4f9afabf",
+            "uses: taiki-e/install-action@6a1bd70eaac3c8bdf093356838d7ee09fda951cf",
             source,
         )
         self.assertIn("tool: cargo-fuzz@0.13.1", source)