diff --git a/.github/workflows/web.yml b/.github/workflows/web.yml
index 2796993c..6de9f30f 100644
--- a/.github/workflows/web.yml
+++ b/.github/workflows/web.yml
@@ -117,7 +117,7 @@ jobs:
       # than straight into `_site/docs`, because the assemble step below clears +
       # recreates `_site`.
       - name: Set up Python for MkDocs
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: "3.12"
 
diff --git a/Cargo.lock b/Cargo.lock
index d1f9185e..6e44963c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -490,9 +490,9 @@ checksum = "64fa3c856b712db6612c019f14756e64e4bcea13337a6b33b696333a9eaa2d06"
 
 [[package]]
 name = "bytemuck"
-version = "1.25.0"
+version = "1.25.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8efb64bd706a16a1bdde310ae86b351e4d21550d98d056f22f8a7f7a2183fec"
+checksum = "d6aedf8ae72766347502cf3cb4f41cf5e9cc37d28bee90f1fdaaae15f9cf9424"
 dependencies = [
  "bytemuck_derive",
 ]
@@ -602,9 +602,9 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.2.66"
+version = "1.2.67"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d6cac793997bd970000024b2934968efe83b382de4fdcf4fcb46b6ee4ad996"
+checksum = "e17dd265a7d0f31ef544e1b20e03add05d3b45b491b633b10d67145d2acc1a38"
 dependencies = [
  "find-msvc-tools",
  "jobserver",
@@ -633,6 +633,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ciborium"
 version = "0.2.2"
@@ -830,6 +841,12 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-str"
 version = "0.5.7"
@@ -1203,6 +1220,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
+ "const-oid",
  "crypto-common 0.2.2",
 ]
 
@@ -1735,6 +1753,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -3549,6 +3568,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2f3a9f18d041e6d0e102a0a46750538147e5e8992d3b4873aaafee2520b00ce3"
 
+[[package]]
+name = "pollster"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc6355899e1c9462875b6757c79f3caa011a1fdae12bbb1a2e72dd1f234f8336"
+
 [[package]]
 name = "polycool"
 version = "0.4.0"
@@ -3734,6 +3759,17 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -3772,6 +3808,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_xorshift"
 version = "0.4.0"
@@ -4034,7 +4076,7 @@ dependencies = [
  "objc2-core-foundation",
  "objc2-foundation 0.3.2",
  "percent-encoding",
- "pollster",
+ "pollster 0.4.0",
  "raw-window-handle",
  "wasm-bindgen",
  "wasm-bindgen-futures",
@@ -4257,7 +4299,7 @@ dependencies = [
  "log",
  "ndk",
  "ndk-context",
- "pollster",
+ "pollster 1.0.1",
  "raw-window-handle",
  "rustynes-gfx-shaders",
  "rustynes-mobile",
@@ -4339,7 +4381,7 @@ dependencies = [
  "md-5",
  "naga",
  "png",
- "pollster",
+ "pollster 1.0.1",
  "ratatui",
  "rfd",
  "rustynes-cheevos",
@@ -4351,7 +4393,7 @@ dependencies = [
  "rustynes-script",
  "serde",
  "serde_json",
- "sha1 0.11.0",
+ "sha1",
  "sha2 0.11.0",
  "tempfile",
  "thiserror 2.0.18",
@@ -4389,7 +4431,7 @@ dependencies = [
  "bytemuck",
  "cpal",
  "log",
- "pollster",
+ "pollster 1.0.1",
  "raw-window-handle",
  "rustynes-gfx-shaders",
  "rustynes-mobile",
@@ -4506,9 +4548,9 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "safe_arch"
-version = "0.7.4"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96b02de82ddbe1b636e6170c21be622223aea188ef2e139be0a5b219ec215323"
+checksum = "1f7caad094bd561859bcd467734a720c3c1f5d1f338995351fefe2190c45efed"
 dependencies = [
  "bytemuck",
 ]
@@ -4635,17 +4677,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "sha1"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
-]
-
 [[package]]
 name = "sha1"
 version = "0.11.0"
@@ -5224,9 +5255,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
 dependencies = [
  "futures-util",
  "log",
@@ -5319,19 +5350,19 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 
 [[package]]
 name = "tungstenite"
-version = "0.29.0"
+version = "0.30.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c01152af293afb9c7c2a57e4b559c5620b421f6d133261c60dd2d0cdb38e6b8"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
 dependencies = [
  "bytes",
  "data-encoding",
  "http",
  "httparse",
  "log",
- "rand 0.9.4",
+ "rand 0.10.2",
  "rustls",
  "rustls-pki-types",
- "sha1 0.10.6",
+ "sha1",
  "thiserror 2.0.18",
  "webpki-roots 0.26.11",
 ]
@@ -6196,9 +6227,9 @@ dependencies = [
 
 [[package]]
 name = "wide"
-version = "0.7.33"
+version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ce5da8ecb62bcd8ec8b7ea19f69a51275e91299be594ea5cc6ef7819e16cd03"
+checksum = "dfdfe6a32973f2d1b268b8895845a8a96cac2f0191e72c27cc929036060dbf89"
 dependencies = [
  "bytemuck",
  "safe_arch",
diff --git a/crates/rustynes-android/Cargo.toml b/crates/rustynes-android/Cargo.toml
index bfe187f4..e2cb6a79 100644
--- a/crates/rustynes-android/Cargo.toml
+++ b/crates/rustynes-android/Cargo.toml
@@ -45,7 +45,7 @@ android_logger = "0.15"
 # `AndroidNdk` window handle wgpu needs.
 wgpu = "29"
 raw-window-handle = "0.6"
-pollster = "0.4"
+pollster = "1.0"
 bytemuck = { version = "1", features = ["derive"] }
 # Shared CRT/scanline WGSL (single source of truth with the desktop frontend).
 rustynes-gfx-shaders.workspace = true
diff --git a/crates/rustynes-frontend/Cargo.toml b/crates/rustynes-frontend/Cargo.toml
index 221f131b..92c9ccc7 100644
--- a/crates/rustynes-frontend/Cargo.toml
+++ b/crates/rustynes-frontend/Cargo.toml
@@ -230,9 +230,12 @@ toml.workspace = true
 serde_json.workspace = true
 sha2.workspace = true
 
-# Frontend-only utilities. Both already in the dependency tree as
-# transitive deps of wgpu; adding them as direct deps is free.
-pollster = "0.4"
+# Frontend-only utilities. `bytemuck` matches the version already resolved
+# transitively (via wgpu), so declaring it direct is free. `pollster` is pinned
+# to 1.0 as an intentional direct dep for `block_on`; note this is a NEW major
+# distinct from the `pollster 0.4` that `rfd` still pulls transitively, so the two
+# coexist as a temporary duplicate until rfd bumps to pollster 1.x.
+pollster = "1.0"
 bytemuck = "1"
 web-time.workspace = true
 
@@ -250,7 +253,7 @@ rustynes-netplay.workspace = true
 # dependency-light. Native-only on purpose — the wasm blitter uses
 # `core::arch::wasm32` v128 intrinsics under `+simd128` (with a scalar fallback),
 # so `wide` never enters the wasm bundle and the 5 MiB size budget is untouched.
-wide = "0.7"
+wide = "1.5"
 
 # v1.7.0 "Forge" G4 — movie-export hash hardening (native export path only, so
 # the wasm size budget is untouched). `.fm2` wants an MD5 `romChecksum`, `.bk2`
diff --git a/crates/rustynes-ios/Cargo.toml b/crates/rustynes-ios/Cargo.toml
index 0ef26fe4..b8058433 100644
--- a/crates/rustynes-ios/Cargo.toml
+++ b/crates/rustynes-ios/Cargo.toml
@@ -44,7 +44,7 @@ log = "0.4"
 [target.'cfg(target_os = "ios")'.dependencies]
 wgpu = "29"
 raw-window-handle = "0.6"
-pollster = "0.4"
+pollster = "1.0"
 bytemuck = { version = "1", features = ["derive"] }
 cpal = "0.18"
 # Shared CRT/scanline/NTSC WGSL (single source of truth with the desktop
diff --git a/crates/rustynes-mobile/Cargo.toml b/crates/rustynes-mobile/Cargo.toml
index 6c893833..4cc47a50 100644
--- a/crates/rustynes-mobile/Cargo.toml
+++ b/crates/rustynes-mobile/Cargo.toml
@@ -75,7 +75,7 @@ zip = { version = "8", default-features = false, features = ["deflate"] }
 # STUN responder, exactly like `rustynes-netplay`'s `tests/nat_loopback.rs`. The
 # blocking `tungstenite` server side mirrors the client the bridge uses; same
 # version + pure-rustls features (no OpenSSL) so the dev build stays consistent.
-tungstenite = { version = "0.29", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"] }
+tungstenite = { version = "0.30", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"] }
 
 [[bin]]
 # The binding generator the platform builds invoke:
diff --git a/crates/rustynes-netplay/Cargo.toml b/crates/rustynes-netplay/Cargo.toml
index d4dd6efa..1726d434 100644
--- a/crates/rustynes-netplay/Cargo.toml
+++ b/crates/rustynes-netplay/Cargo.toml
@@ -37,7 +37,7 @@ thiserror = { workspace = true, features = ["std"] }
 # only the async WebSocket plumbing in `examples/signaling_server.rs`.
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 tokio = { version = "1", features = ["rt-multi-thread", "net", "macros", "sync", "time", "io-util"], optional = true }
-tokio-tungstenite = { version = "0.29", optional = true }
+tokio-tungstenite = { version = "0.30", optional = true }
 futures-util = { version = "0.3", optional = true }
 serde_json = { version = "1.0", optional = true }
 
@@ -45,7 +45,7 @@ serde_json = { version = "1.0", optional = true }
 # worker. `rustls-tls-webpki-roots` keeps it pure-Rust TLS (no system OpenSSL),
 # which is what lets it cross-compile cleanly to aarch64-linux-android. No async
 # runtime: this is the blocking `tungstenite::connect` + `read`/`send` API.
-tungstenite = { version = "0.29", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"], optional = true }
+tungstenite = { version = "0.30", default-features = false, features = ["handshake", "rustls-tls-webpki-roots"], optional = true }
 
 # v2.5.0 Phase C — WebRTC transport scaffold for the browser (wasm32 only).
 # The native build (UDP/std::net) needs none of these; on wasm they back the