diff --git a/crates/pm/src/util/retry.rs b/crates/pm/src/util/retry.rs
index d47378cf7e..870d9d7266 100644
--- a/crates/pm/src/util/retry.rs
+++ b/crates/pm/src/util/retry.rs
@@ -28,6 +28,17 @@ pub fn build_dns_cached_client() -> reqwest::Client {
     client_builder()
         .connect_timeout(std::time::Duration::from_secs(5)) // TLS + TCP handshake
         .read_timeout(std::time::Duration::from_secs(30)) // Timeout for individual read operations
+        // Tarballs are already gzip; don't invite a second Content-Encoding
+        // layer that would just burn CPU on decode.
+        .no_gzip()
+        // HTTP/1.1 so each in-flight tarball gets its own TCP connection.
+        // With ALPN h2 the registry CDN multiplexes every stream over one
+        // connection (single congestion window + flow-control cap, loss on
+        // one stream stalls siblings) — same rationale as the manifest
+        // client in ruborist/src/service/http.rs. Same-runner A/B measured
+        // h2 at +9.8% on p3 cold install against npmjs and +35% against
+        // npmmirror.
+        .http1_only()
         // No total timeout - large files (e.g. node binary ~100MB) need longer download time
         // No pool_max_idle_per_host - let reqwest manage connections freely
         // Concurrency is bounded by the resolver's in-flight fetch cap
diff --git a/crates/ruborist/Cargo.toml b/crates/ruborist/Cargo.toml
index 4b23ba32c2..cee6b29dd1 100644
--- a/crates/ruborist/Cargo.toml
+++ b/crates/ruborist/Cargo.toml
@@ -53,8 +53,11 @@ workspace = true
 tokio = { workspace = true, features = ["macros", "rt"] }
 
 # Native (non-macOS) targets: reqwest's default rustls + ring.
+# `gzip` lets the manifest client send Accept-Encoding and transparently
+# decompress packuments (~2.5x smaller on registry.npmjs.org); brotli is
+# only ~1% smaller than gzip there but decodes slower, so it stays off.
 [target.'cfg(not(any(target_arch = "wasm32", target_os = "macos")))'.dependencies]
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots"] }
+reqwest = { version = "0.12", default-features = false, features = ["gzip", "rustls-tls-native-roots"] }
 
 # Native-only dependencies (not compiled for WASM)
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
@@ -73,7 +76,10 @@ js-sys = "0.3"
 # resolves on M-series ARM. CI bench-phases regresses on Linux/x86_64
 # with this provider, so it's gated to macOS only. See service/http.rs.
 [target.'cfg(target_os = "macos")'.dependencies]
-reqwest             = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots-no-provider"] }
+reqwest             = { version = "0.12", default-features = false, features = [
+  "gzip",
+  "rustls-tls-native-roots-no-provider"
+] }
 rustls              = { version = "0.23", default-features = false, features = ["aws-lc-rs", "logging", "std", "tls12"] }
 rustls-native-certs = "0.8"