diff --git a/.tool-versions b/.tool-versions
index 1b29972c26..d29345dba2 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,7 +1,8 @@
-fastly    15.1.0
-rust      1.95.0
-nodejs    24.12.0
-viceroy   0.17.0
-wasmtime  44.0.1
+fastly    16.0.0
+rust      1.98.1
+nodejs    24.20.0
+viceroy   0.21.0
+wasmtime  48.0.1
+spin      4.1.0
 awscli    2.36.45
 terraform 1.16.2
diff --git a/AGENTS.md b/AGENTS.md
index ec97980f0d..a88d0df59e 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -33,12 +33,13 @@ Supporting files: `edgezero.toml`, `fastly.toml`,
 
 | Tool        | Version / Target                         |
 | ----------- | ---------------------------------------- |
-| Rust        | 1.95.0 (pinned in `rust-toolchain.toml`) |
+| Rust        | 1.98.1 (pinned in `rust-toolchain.toml`) |
 | WASM target | `wasm32-wasip1`                          |
-| Node        | 24.12.0 (from `.tool-versions`)          |
-| Fastly CLI  | 15.1.0 (from `.tool-versions`)           |
-| Viceroy     | 0.17.0 (from `.tool-versions`)           |
-| Wasmtime    | 44.0.1 (from `.tool-versions`)           |
+| Node        | 24.20.0 (from `.tool-versions`)          |
+| Fastly CLI  | 16.0.0 (from `.tool-versions`)           |
+| Viceroy     | 0.21.0 (from `.tool-versions`)           |
+| Wasmtime    | 48.0.1 (from `.tool-versions`)           |
+| Spin        | 4.1.0 (from `.tool-versions`)            |
 | AWS CLI     | 2.36.45 (from `.tool-versions`)          |
 | Terraform   | 1.16.2 (from `.tool-versions`)           |
 
@@ -158,7 +159,7 @@ cd crates/trusted-server-js/lib && node build-all.mjs
 ### Install prerequisites
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
@@ -352,7 +353,7 @@ IntegrationRegistration::builder(ID)
 | `fastly.toml`                 | Fastly service configuration and build settings                                                   |
 | `trusted-server.example.toml` | Source-controlled Trusted Server app-config template                                              |
 | `trusted-server.toml`         | Operator-owned app config; gitignored; `ts config push` publishes it as an EdgeZero blob envelope |
-| `rust-toolchain.toml`         | Pins Rust version to 1.95.0                                                                       |
+| `rust-toolchain.toml`         | Pins Rust version to 1.98.1                                                                       |
 | `.env.dev`                    | Local development environment variables                                                           |
 
 ---
diff --git a/Cargo.lock b/Cargo.lock
index 00dff9fc05..7ebc0b08ea 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -10,24 +10,12 @@ checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"
 
 [[package]]
 name = "aead"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
-dependencies = [
- "crypto-common",
- "generic-array",
-]
-
-[[package]]
-name = "ahash"
-version = "0.8.12"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"
+checksum = "1973cfbc1a2daf9cf550e74e1f088c28e7f7d8c1e1418fb6c9dc5184b7e84c99"
 dependencies = [
- "cfg-if",
- "once_cell",
- "version_check",
- "zerocopy",
+ "crypto-common 0.2.2",
+ "inout",
 ]
 
 [[package]]
@@ -381,6 +369,12 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"
 
+[[package]]
+name = "base16ct"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd307490d624467aa6f74b0eabb77633d1f758a7b25f12bceb0b22e08d9726f6"
+
 [[package]]
 name = "base64"
 version = "0.22.1"
@@ -435,6 +429,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "bollard"
 version = "0.19.4"
@@ -610,17 +613,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
-[[package]]
-name = "chacha20"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
-dependencies = [
- "cfg-if",
- "cipher",
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "chacha20"
 version = "0.10.1"
@@ -628,21 +620,21 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
+ "cipher",
  "cpufeatures 0.3.0",
  "rand_core 0.10.1",
 ]
 
 [[package]]
 name = "chacha20poly1305"
-version = "0.10.1"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
+checksum = "9b89e1c441e926b9c82a8d023f6e1b7ae0adcfaa7d621814e4d60789bac751cb"
 dependencies = [
  "aead",
- "chacha20 0.9.1",
+ "chacha20",
  "cipher",
  "poly1305",
- "zeroize",
 ]
 
 [[package]]
@@ -753,13 +745,13 @@ dependencies = [
 
 [[package]]
 name = "cipher"
-version = "0.4.4"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
+checksum = "e8cf2a2c93cd704877c0858356ed03480ff301ee950b43f1cbe4573b088bfa6c"
 dependencies = [
- "crypto-common",
+ "block-buffer 0.12.1",
+ "crypto-common 0.2.2",
  "inout",
- "zeroize",
 ]
 
 [[package]]
@@ -820,6 +812,12 @@ dependencies = [
  "cc",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "colorchoice"
 version = "1.0.5"
@@ -889,6 +887,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -1064,10 +1068,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
 dependencies = [
  "generic-array",
- "rand_core 0.6.4",
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "cssparser"
 version = "0.35.0"
@@ -1114,6 +1126,15 @@ dependencies = [
  "linktime-proc-macro",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03bb0e1cc970d482d121d9a1744999169b69a07470b3d644a7894e53fcaf4574"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "curve25519-dalek"
 version = "4.1.3"
@@ -1268,7 +1289,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "zeroize",
 ]
 
@@ -1371,9 +1392,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
- "crypto-common",
- "subtle",
+ "const-oid 0.9.6",
+ "crypto-common 0.1.7",
+]
+
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid 0.10.2",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -1498,11 +1530,12 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
+ "base16ct 1.0.0",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.1",
  "toml",
  "walkdir",
 ]
@@ -1510,7 +1543,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-axum"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1538,7 +1571,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-cloudflare"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1561,11 +1594,12 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-fastly"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "brotli",
  "bytes",
  "chrono",
@@ -1581,7 +1615,7 @@ dependencies = [
  "log-fastly",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.1",
  "thiserror 2.0.18",
  "toml_edit 0.25.12+spec-1.1.0",
  "walkdir",
@@ -1590,7 +1624,7 @@ dependencies = [
 [[package]]
 name = "edgezero-adapter-spin"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -1617,7 +1651,7 @@ dependencies = [
 [[package]]
 name = "edgezero-cli"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "chrono",
  "clap",
@@ -1632,7 +1666,7 @@ dependencies = [
  "log",
  "serde",
  "serde_json",
- "similar",
+ "similar 3.2.0",
  "simple_logger",
  "thiserror 2.0.18",
  "toml",
@@ -1642,12 +1676,13 @@ dependencies = [
 [[package]]
 name = "edgezero-core"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "anyhow",
  "async-compression",
  "async-stream",
  "async-trait",
+ "base16ct 1.0.0",
  "bytes",
  "edgezero-macros",
  "futures",
@@ -1661,7 +1696,7 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sha2 0.10.9",
+ "sha2 0.11.1",
  "thiserror 2.0.18",
  "toml",
  "tower-service",
@@ -1673,7 +1708,7 @@ dependencies = [
 [[package]]
 name = "edgezero-macros"
 version = "0.1.0"
-source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.9#f7176742d46aa4d1a04ce4588b606afda388fd30"
+source = "git+https://github.com/IABTechLab/edgezero?tag=v0.0.10#85d933b8044dec29fe9e4685cae194eaf0290911"
 dependencies = [
  "log",
  "proc-macro2",
@@ -1703,7 +1738,7 @@ version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "crypto-bigint",
  "digest 0.10.7",
  "ff",
@@ -1797,8 +1832,7 @@ dependencies = [
 [[package]]
 name = "esi"
 version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "026264c3022569f7bc5052f9452362537e923b34ecc9248b803437c2b89cdd81"
+source = "git+https://github.com/stackpop/esi?rev=75bfbb396d4cb7792610f1287cbec61675f13f38#75bfbb396d4cb7792610f1287cbec61675f13f38"
 dependencies = [
  "atoi",
  "base64",
@@ -1850,9 +1884,9 @@ dependencies = [
 
 [[package]]
 name = "fastly"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "531e4c3df48350d9f4fc95b4deaf87fd29820336b7926bb84bf460457c2a126b"
+checksum = "3c5c07c0c67d0b5826d1cb2311e563a17860b50e2ae89e1c703d6400d904d1e2"
 dependencies = [
  "anyhow",
  "bytes",
@@ -1863,7 +1897,6 @@ dependencies = [
  "fastly-sys",
  "http",
  "itertools 0.13.0",
- "lazy_static",
  "mime",
  "serde",
  "serde_json",
@@ -1878,9 +1911,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-macros"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc2aef5f9690b04c8890f9a54ddb591b12b9779ec25ee0e572d207106e52e3d8"
+checksum = "698025eab5612adab20df48963a5126650893014e8505af02a0af20939ee6a05"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1889,9 +1922,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-shared"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "080ad138403159fd366d3e0b14bb49cb0c01dc18c25095bbbd1c85e3338f5413"
+checksum = "191c2cf082f5d17f4ca0685cedaa0642ad4ade949fac8d1dbdd62ff756b13500"
 dependencies = [
  "bitflags 1.3.2",
  "http",
@@ -1899,9 +1932,9 @@ dependencies = [
 
 [[package]]
 name = "fastly-sys"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "de75ef193f6c29c43d667458bede648970715aedd5db2d42c2eba3ffa3ad738b"
+checksum = "239c77706cf9110b423a89b6b03b8011729b144390d2a7f641d95ef66b2768b8"
 dependencies = [
  "bitflags 1.3.2",
  "fastly-shared",
@@ -2561,7 +2594,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1c91d8cffac8849493a82233811bd02b2b183b8cf39bf704de0fa0841b737595"
 dependencies = [
  "bstr",
- "hashbrown 0.17.1",
+ "hashbrown 0.16.1",
 ]
 
 [[package]]
@@ -3127,9 +3160,6 @@ name = "hashbrown"
 version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5274423e17b7c9fc20b6e7e208532f9b19825d82dfd615708b70edd83df41f1"
-dependencies = [
- "ahash",
-]
 
 [[package]]
 name = "hashbrown"
@@ -3153,15 +3183,6 @@ dependencies = [
  "foldhash",
 ]
 
-[[package]]
-name = "hashlink"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ba4ff7128dee98c7dc9794b6a411377e1404dba1c97deb8d1a55297bd25d8af"
-dependencies = [
- "hashbrown 0.14.5",
-]
-
 [[package]]
 name = "hashlink"
 version = "0.11.1"
@@ -3201,11 +3222,11 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "hmac"
-version = "0.12.1"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -3279,6 +3300,15 @@ version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "df3b46402a9d5adb4c86a0cf463f42e19994e3ee891101b1841f30a545cb49a9"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27f864f10dfb56725ce5ce5472bc52252c8f93a4ab86327122cebf62c5f59a17"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.10.1"
@@ -3579,11 +3609,11 @@ dependencies = [
 
 [[package]]
 name = "inout"
-version = "0.1.4"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "879f10e63c20629ecabbb64a8010319738c66a5cd0c29b02d63d272b03751d01"
+checksum = "3ce983bb6fb399067d101fbfc9e74174e07e9f29a2bc679efefeb8c645819c3f"
 dependencies = [
- "generic-array",
+ "hybrid-array",
 ]
 
 [[package]]
@@ -3849,9 +3879,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.30.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -3905,9 +3935,9 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "log-fastly"
-version = "0.12.1"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51dae5def13a2d557fdb63862d642f8d4641ec3773c036bb14092697b6764013"
+checksum = "433713b6191ad3e1d5248db9536f3e2d99a12d7ff998afd272a98d96e6dbc2ed"
 dependencies = [
  "fastly",
  "log",
@@ -4591,12 +4621,11 @@ checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
 [[package]]
 name = "poly1305"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
+checksum = "6e2d0073b297041425c7c3df6eb4792d598a15323fe63346852b092eca02904c"
 dependencies = [
- "cpufeatures 0.2.17",
- "opaque-debug",
+ "cpufeatures 0.3.0",
  "universal-hash",
 ]
 
@@ -4938,7 +4967,7 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
 dependencies = [
- "chacha20 0.10.1",
+ "chacha20",
  "getrandom 0.4.3",
  "rand_core 0.10.1",
 ]
@@ -5003,9 +5032,9 @@ dependencies = [
 
 [[package]]
 name = "redb"
-version = "4.1.0"
+version = "4.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e925444704b5f17d32bf42f5b6e2df050bceebc3dcd6e71cc73dafe8092e839"
+checksum = "39178e0a867f9e3eaa6292a4ab1dd3613f2519c5b564341e1e7b29b270736cc4"
 dependencies = [
  "libc",
 ]
@@ -5205,7 +5234,7 @@ version = "0.9.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "digest 0.10.7",
  "num-bigint-dig",
  "num-integer",
@@ -5231,14 +5260,13 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.32.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7753b721174eb8ff87a9a0e799e2d7bc3749323e773db92e0984debb00019d6e"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.0",
  "fallible-iterator",
  "fallible-streaming-iterator",
- "hashlink 0.9.1",
  "libsqlite3-sys",
  "smallvec",
 ]
@@ -5457,7 +5485,7 @@ version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct",
+ "base16ct 0.2.0",
  "der",
  "generic-array",
  "subtle",
@@ -5740,6 +5768,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "47d7069beb7d6ac7b9acd1039986e73443f24234f41074da099d6f994ac9ad19"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "shell-words"
 version = "1.1.1"
@@ -5800,6 +5839,15 @@ version = "2.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbbb5d9659141646ae647b42fe094daf6c6192d1620870b449d9557f748b2daa"
 
+[[package]]
+name = "similar"
+version = "3.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f66ca1f7aca2474dc10c942eb22feffc897735f54cd1db90138c2fddb490987"
+dependencies = [
+ "bstr",
+]
+
 [[package]]
 name = "simple_logger"
 version = "5.2.0"
@@ -5848,9 +5896,9 @@ checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
 
 [[package]]
 name = "spin-macro"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11e483b94d5bcfac493caf0427fa875063e3e8604d0466a4ab491ec200a42857"
+checksum = "ac8a641da857d4e7cada31a853c40180eeb10485a0f2f0282d0a7e5a2a4105d4"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5859,9 +5907,9 @@ dependencies = [
 
 [[package]]
 name = "spin-sdk"
-version = "6.0.0"
+version = "7.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fd2abac3eb2ee249c2241ab87f7b1287f36172c8cc1ea815c19c85e41ede44d"
+checksum = "2b7a3d9a6805ccdb4d404e91ccf7198ac5e486b6199dc9387aeebaa368272112"
 dependencies = [
  "anyhow",
  "bytes",
@@ -6615,7 +6663,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml_ng",
- "similar",
+ "similar 2.7.0",
  "temp-env",
  "tempfile",
  "time",
@@ -6669,7 +6717,7 @@ dependencies = [
  "regex",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.1",
  "subtle",
  "temp-env",
  "tempfile",
@@ -6720,7 +6768,7 @@ version = "0.1.0"
 dependencies = [
  "build-print",
  "hex",
- "sha2 0.10.9",
+ "sha2 0.11.1",
  "which",
 ]
 
@@ -6832,12 +6880,12 @@ checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
 
 [[package]]
 name = "universal-hash"
-version = "0.5.1"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
+checksum = "f4987bdc12753382e0bec4a65c50738ffaabc998b9cdd1f952fb5f39b0048a96"
 dependencies = [
- "crypto-common",
- "subtle",
+ "crypto-common 0.2.2",
+ "ctutils",
 ]
 
 [[package]]
@@ -6935,12 +6983,11 @@ dependencies = [
 
 [[package]]
 name = "validator"
-version = "0.20.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43fb22e1a008ece370ce08a3e9e4447a910e92621bb49b85d6e48a45397e7cfa"
+checksum = "c3d68c6633c483df6780cc5277a417c7c2d1bceee2649d06c8ab6b0fd2dd3c81"
 dependencies = [
  "idna",
- "once_cell",
  "regex",
  "serde",
  "serde_derive",
@@ -7020,9 +7067,9 @@ dependencies = [
 
 [[package]]
 name = "wasip3"
-version = "0.6.0+wasi-0.3.0-rc-2026-03-15"
+version = "0.7.1+wasi-0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed83456dd6a0b8581998c0365e4651fa2997e5093b49243b7f35391afaa7a3d9"
+checksum = "75e9ed91ee5a995b6fe16c89d4511a8c12eb76967be20b57557618e02e781bcc"
 dependencies = [
  "bytes",
  "http",
@@ -7669,7 +7716,7 @@ checksum = "631a50d867fafb7093e709d75aaee9e0e0d5deb934021fcea25ac2fe09edc51e"
 dependencies = [
  "arraydeque",
  "encoding_rs",
- "hashlink 0.11.1",
+ "hashlink",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 2d56af4bb2..72fecdf6b5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ base64 = "0.22"
 brotli = "8.0"
 build-print = "1.0.1"
 bytes = "1.11"
-chacha20poly1305 = "0.10"
+chacha20poly1305 = { version = "0.11", default-features = false, features = ["alloc"] }
 chrono = "0.4.44"
 chromiumoxide = "0.9.1"
 clap = { version = "4", features = ["derive"] }
@@ -56,16 +56,16 @@ cssparser = "0.36"
 derive_more = { version = "2.0", features = ["display", "error"] }
 directories = "5"
 ed25519-dalek = { version = "2.2", features = ["rand_core"] }
-edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9", default-features = false }
-edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9", default-features = false }
-edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9", default-features = false }
-edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9", default-features = false }
-edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9" }
-edgezero-core = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.9", default-features = false }
+edgezero-adapter-axum = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10", default-features = false }
+edgezero-adapter-cloudflare = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10", default-features = false }
+edgezero-adapter-fastly = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10", default-features = false }
+edgezero-adapter-spin = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10", default-features = false }
+edgezero-cli = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10" }
+edgezero-core = { git = "https://github.com/IABTechLab/edgezero", tag = "v0.0.10", default-features = false }
 env_logger = "0.11"
 error-stack = "0.6"
 esi = "0.7.2"
-fastly = "0.12"
+fastly = "0.13"
 fern = "0.7.1"
 flate2 = "1.1"
 futures = "0.3"
@@ -76,7 +76,7 @@ gix = { version = "0.83", default-features = false }
 glob = "0.3"
 getrandom = "0.2"
 hex = "0.4.3"
-hmac = "0.12.1"
+hmac = "0.13"
 http = "1.4.0"
 httpdate = "1.0.3"
 http-body-util = "0.1"
@@ -87,7 +87,7 @@ jose-jwk = "0.1.2"
 js-sys = "0.3"
 libc = "0.2"
 log = "0.4.29"
-log-fastly = "0.12"
+log-fastly = "0.13"
 lol_html = "2.7.2"
 matchit = "0.9"
 mime = "0.3"
@@ -104,10 +104,10 @@ scraper = "0.24.0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.149"
 serde_yaml_ng = "0.10"
-sha2 = "0.10.9"
+sha2 = "0.11"
 similar = "2.7"
 simple_logger = "5"
-spin-sdk = { version = "~6.0", default-features = false, features = ["http", "key-value", "variables"] }
+spin-sdk = { version = "~7.0", default-features = false, features = ["http", "key-value", "variables"] }
 subtle = "2.6"
 temp-env = "0.3.6"
 tempfile = "3.24"
@@ -125,13 +125,20 @@ trusted-server-openrtb = { path = "crates/trusted-server-openrtb" }
 url = "2.5.8"
 urlencoding = "2.1"
 uuid = { version = "1.18", features = ["v4"] }
-validator = { version = "0.20", features = ["derive"] }
+validator = { version = "0.21", features = ["derive"] }
 web-time = "1"
 webpki-roots = "1"
 which = "8"
 worker = { version = "0.8", default-features = false, features = ["http"] }
 x509-parser = "0.16"
 
+# `esi` 0.7.2 pins `fastly = "^0.12"` while EdgeZero requires 0.13, and both
+# meet in `trusted-server-adapter-fastly`. The fork carries the range bump
+# and no source change (stackpop/esi@chore/fastly-0.13); drop this patch
+# once the fix is released upstream. See issue #1122.
+[patch.crates-io]
+esi = { git = "https://github.com/stackpop/esi", rev = "75bfbb396d4cb7792610f1287cbec61675f13f38" }
+
 [workspace.lints.clippy]
 # Correctness - Force explicit error handling in production code
 unwrap_used = "deny"
diff --git a/crates/trusted-server-cli/src/run.rs b/crates/trusted-server-cli/src/run.rs
index 1639fd3cbd..05b4779f8f 100644
--- a/crates/trusted-server-cli/src/run.rs
+++ b/crates/trusted-server-cli/src/run.rs
@@ -187,7 +187,6 @@ fn dispatch(args: Args) -> Result<RunOutcome, String> {
 mod tests {
     use std::path::PathBuf;
 
-    use clap::Parser as _;
     use edgezero_cli::args::{AuthSub, ConfigDiffArgs, ConfigPushArgs, ConfigValidateArgs};
 
     use super::*;
diff --git a/crates/trusted-server-core/src/ec/generation.rs b/crates/trusted-server-core/src/ec/generation.rs
index 2924b76925..6b9ed27166 100644
--- a/crates/trusted-server-core/src/ec/generation.rs
+++ b/crates/trusted-server-core/src/ec/generation.rs
@@ -6,7 +6,7 @@
 use std::net::IpAddr;
 
 use error_stack::{Report, ResultExt};
-use hmac::{Hmac, Mac};
+use hmac::{Hmac, KeyInit as _, Mac};
 use rand::Rng;
 use sha2::Sha256;
 
diff --git a/crates/trusted-server-core/src/ec/pull_sync_marker.rs b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
index f2a2fe6013..11df47296f 100644
--- a/crates/trusted-server-core/src/ec/pull_sync_marker.rs
+++ b/crates/trusted-server-core/src/ec/pull_sync_marker.rs
@@ -3,7 +3,7 @@
 use core::fmt;
 
 use edgezero_core::body::Body as EdgeBody;
-use hmac::{Hmac, Mac as _};
+use hmac::{Hmac, KeyInit as _, Mac as _};
 use http::{HeaderValue, Response, header};
 use sha2::{Digest as _, Sha256};
 
diff --git a/crates/trusted-server-core/src/http_util.rs b/crates/trusted-server-core/src/http_util.rs
index 457e503568..e12eefdbbb 100644
--- a/crates/trusted-server-core/src/http_util.rs
+++ b/crates/trusted-server-core/src/http_util.rs
@@ -359,15 +359,15 @@ pub fn encode_url(settings: &Settings, plaintext_url: &str) -> String {
     let nonce_full = hasher.finalize();
     let mut nonce = [0_u8; 24];
     nonce[..24].copy_from_slice(&nonce_full[..24]);
-    let nonce = XNonce::from_slice(&nonce);
+    let nonce = XNonce::from(nonce);
 
     let ciphertext = cipher
-        .encrypt(nonce, plaintext_url.as_bytes())
+        .encrypt(&nonce, plaintext_url.as_bytes())
         .expect("encryption failure");
 
     let mut out: Vec<u8> = Vec::with_capacity(2 + 24 + ciphertext.len());
     out.extend_from_slice(b"x1");
-    out.extend_from_slice(nonce);
+    out.extend_from_slice(&nonce);
     out.extend_from_slice(&ciphertext);
     URL_SAFE_NO_PAD.encode(out)
 }
@@ -383,12 +383,12 @@ pub fn decode_url(settings: &Settings, token: &str) -> Option<String> {
         return None;
     }
     let nonce_bytes = &data[2..2 + 24];
-    let nonce = XNonce::from_slice(nonce_bytes);
+    let nonce = XNonce::try_from(nonce_bytes).ok()?;
     let ciphertext = &data[2 + 24..];
 
     let key_bytes = Sha256::digest(settings.publisher.proxy_secret.expose().as_bytes());
     let cipher = XChaCha20Poly1305::new(&key_bytes);
-    let pt = cipher.decrypt(nonce, ciphertext).ok()?;
+    let pt = cipher.decrypt(&nonce, ciphertext).ok()?;
     String::from_utf8(pt).ok()
 }
 
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index e87d8939d1..4dfe4e5a25 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -7273,7 +7273,7 @@ fn mark_deprecated_alias(response: &mut Response<EdgeBody>, is_legacy_alias: boo
 #[cfg(test)]
 mod tests {
     use std::future::Future as _;
-    use std::io::{self, Read as _, Write as _};
+    use std::io::{self, Read as _};
     use std::sync::atomic::{AtomicUsize, Ordering};
 
     use brotli::Decompressor;
diff --git a/crates/trusted-server-core/src/s3_sigv4.rs b/crates/trusted-server-core/src/s3_sigv4.rs
index 1a862882ed..dc4dc25ad2 100644
--- a/crates/trusted-server-core/src/s3_sigv4.rs
+++ b/crates/trusted-server-core/src/s3_sigv4.rs
@@ -14,7 +14,7 @@ use std::time::SystemTime;
 
 use chrono::{DateTime, Utc};
 use error_stack::Report;
-use hmac::{Hmac, Mac as _};
+use hmac::{Hmac, KeyInit as _, Mac as _};
 use http::{HeaderMap, HeaderValue, Method, header};
 use sha2::{Digest as _, Sha256};
 use url::Url;
diff --git a/crates/trusted-server-core/src/settings_data.rs b/crates/trusted-server-core/src/settings_data.rs
index 2999eccf35..86616ad69d 100644
--- a/crates/trusted-server-core/src/settings_data.rs
+++ b/crates/trusted-server-core/src/settings_data.rs
@@ -196,7 +196,7 @@ fn resolve_fastly_chunk_pointer(
 }
 
 fn sha256_hex(bytes: &[u8]) -> String {
-    format!("{:x}", Sha256::digest(bytes))
+    hex::encode(Sha256::digest(bytes))
 }
 
 fn configuration_error<T>(message: String) -> Result<T, Report<TrustedServerError>> {
diff --git a/docs/guide/error-reference.md b/docs/guide/error-reference.md
index c8d48be43d..c2ddcebbd9 100644
--- a/docs/guide/error-reference.md
+++ b/docs/guide/error-reference.md
@@ -659,7 +659,7 @@ Warning: viceroy version mismatch
 **Solution:**
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 ---
diff --git a/docs/guide/getting-started.md b/docs/guide/getting-started.md
index a6ee362256..8ff0b435cc 100644
--- a/docs/guide/getting-started.md
+++ b/docs/guide/getting-started.md
@@ -50,7 +50,7 @@ Simulates the full Fastly production environment locally.
 Install and configure the Fastly CLI using the [Fastly setup guide](/guide/fastly), then install Viceroy:
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 ```
 
 Create and push the starter config, then start the local Fastly simulator:
diff --git a/docs/guide/spin.md b/docs/guide/spin.md
index a0e2f8fd31..1a0b5c5a7f 100644
--- a/docs/guide/spin.md
+++ b/docs/guide/spin.md
@@ -15,9 +15,31 @@ auction provider. When startup fails, its hardened router preserves `/health`
 but answers publisher routes with 503; neither response proves successful
 configuration.
 
+## Prerequisites
+
+Spin 4.1.0 or newer, pinned as `spin` in `.tool-versions`. `spin-sdk` 7 imports
+`wasi:http/types@0.3.0`, which Spin 4.0.x does not provide, so an older runtime
+cannot start the component. Install or upgrade from the
+[Spin install guide](https://spinframework.dev/install).
+
+asdf has no first-party Spin plugin, so `asdf install` does not provide this
+one; install it directly, or add a community plugin if you want asdf to manage
+it. The pin records the required version and is what the smoke checks against.
+
+Nothing in the build catches this. The component compiles, `cargo
+test-spin` passes, and only `spin up` reports:
+
+```
+Error: component imports instance `wasi:http/types@0.3.0`, but a
+matching implementation was not found in the linker
+```
+
+`./scripts/smoke-spin.sh` checks the runtime version before it starts the app,
+so it fails with a clear message rather than that linker error.
+
 ## Verify the complete local handoff
 
-With the Spin CLI installed, run:
+With Spin 4.1.0 or newer installed, run:
 
 ```bash
 ./scripts/smoke-spin.sh
diff --git a/docs/guide/testing.md b/docs/guide/testing.md
index 86c0259086..e86c9ab8f3 100644
--- a/docs/guide/testing.md
+++ b/docs/guide/testing.md
@@ -25,7 +25,7 @@ The aliases in `.cargo/config.toml` select the correct target and feature set:
 Fastly tests require the Viceroy version recorded in `.tool-versions`:
 
 ```bash
-cargo install viceroy --version 0.17.0 --locked --force
+cargo install viceroy --version 0.21.0 --locked --force
 rustup target add wasm32-wasip1 wasm32-unknown-unknown
 ```
 
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index e72500aa19..b21f5b55e9 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -1,3 +1,3 @@
 [toolchain]
-channel = "1.95.0"
+channel = "1.98.1"
 targets = [ "wasm32-wasip1", "wasm32-unknown-unknown" ]
diff --git a/scripts/integration-tests-browser.sh b/scripts/integration-tests-browser.sh
index e81767be32..07b0e0a047 100755
--- a/scripts/integration-tests-browser.sh
+++ b/scripts/integration-tests-browser.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #   - Node.js with npx available
 #
diff --git a/scripts/integration-tests.sh b/scripts/integration-tests.sh
index 96e492f40a..2071559967 100755
--- a/scripts/integration-tests.sh
+++ b/scripts/integration-tests.sh
@@ -7,7 +7,7 @@
 #
 # Prerequisites:
 #   - Docker running
-#   - Viceroy installed: cargo install viceroy --version 0.17.0 --locked --force
+#   - Viceroy installed: cargo install viceroy --version 0.21.0 --locked --force
 #   - wasm32-wasip1 target: rustup target add wasm32-wasip1
 #
 set -euo pipefail
diff --git a/scripts/smoke-common.sh b/scripts/smoke-common.sh
index 9335c42ddd..4885472c47 100644
--- a/scripts/smoke-common.sh
+++ b/scripts/smoke-common.sh
@@ -12,6 +12,28 @@ smoke_require_command() {
     command -v "$1" >/dev/null 2>&1 || smoke_die "required command not found: $1"
 }
 
+smoke_require_spin_version() {
+    # `.tool-versions` is the single source of truth for the pinned version, so
+    # the floor is read from there rather than restated here. spin-sdk 7 imports
+    # wasi:http/types@0.3.0, which Spin 4.0.x cannot link.
+    local versions="${BASH_SOURCE[0]%/*}/../.tool-versions"
+    local minimum
+    minimum=$(awk '$1 == "spin" { print $2; exit }' "$versions" 2>/dev/null)
+    [ -n "$minimum" ] || smoke_die "no spin version pinned in .tool-versions"
+    local raw
+    raw=$(spin --version 2>/dev/null) || smoke_die "could not run: spin --version"
+    local found
+    found=$(printf '%s\n' "$raw" | sed -n '1s/^spin \([0-9][0-9.]*\).*/\1/p')
+    [ -n "$found" ] || smoke_die "could not parse a version from: $raw"
+    # The component still builds and its tests still pass, so only `spin up`
+    # surfaces the mismatch; check the runtime before starting the app.
+    local lowest
+    lowest=$(printf '%s\n%s\n' "$minimum" "$found" | sort -V | head -1)
+    if [ "$lowest" != "$minimum" ]; then
+        smoke_die "spin $minimum or newer is required (found $found); spin-sdk 7 imports wasi:http/types@0.3.0, which earlier runtimes cannot link. Install from https://spinframework.dev/install"
+    fi
+}
+
 smoke_make_workspace() {
     local adapter="$1"
     local base="${TMPDIR:-/tmp}"
diff --git a/scripts/smoke-spin.sh b/scripts/smoke-spin.sh
index 382f02ca83..3384dcf03b 100755
--- a/scripts/smoke-spin.sh
+++ b/scripts/smoke-spin.sh
@@ -12,6 +12,7 @@ smoke_require_command curl
 smoke_require_command python3
 smoke_require_command spin
 smoke_require_command pgrep
+smoke_require_spin_version
 
 WORKSPACE=$(smoke_make_workspace spin)
 ORIGIN_PORT=${SPIN_SMOKE_ORIGIN_PORT:-19189}
diff --git a/scripts/template-cache-local-test.sh b/scripts/template-cache-local-test.sh
index a2a0f0b32c..01efe9a9fd 100755
--- a/scripts/template-cache-local-test.sh
+++ b/scripts/template-cache-local-test.sh
@@ -72,7 +72,7 @@ cleanup() {
 trap cleanup EXIT INT TERM
 
 command -v viceroy >/dev/null || {
-  echo "viceroy not found. Install: cargo install viceroy --version 0.17.0 --locked" >&2
+  echo "viceroy not found. Install: cargo install viceroy --version 0.21.0 --locked" >&2
   exit 1
 }
 command -v node >/dev/null || {