diff --git a/src/server/auth0-server.test.ts b/src/server/auth0-server.test.ts
index f837e8e..e897cef 100644
--- a/src/server/auth0-server.test.ts
+++ b/src/server/auth0-server.test.ts
@@ -9,7 +9,7 @@ const serverClientArgs: unknown[] = []
 // The domain-resolver wrapper reads the ambient request via `getRequest()`. Mock
 // it so a test can drive what the wrapper sees on each call.
 let currentRequest: Request
-vi.mock('@tanstack/start-server-core', () => ({
+vi.mock('@tanstack/start-server-core/request-response', () => ({
   getRequest: () => currentRequest,
 }))
 
diff --git a/src/server/auth0-server.ts b/src/server/auth0-server.ts
index ed7466d..b768ee6 100644
--- a/src/server/auth0-server.ts
+++ b/src/server/auth0-server.ts
@@ -6,7 +6,7 @@ import {
   type StateStore,
   type DomainResolver as FoundationDomainResolver,
 } from '@auth0/auth0-server-js'
-import { getRequest } from '@tanstack/start-server-core'
+import { getRequest } from '@tanstack/start-server-core/request-response'
 import { TanStackStartCookieHandler } from './cookie-handler.js'
 import { getConfig, resolveRoutePaths, type ResolvedConfig } from './config.js'
 import type { Auth0ServerOptions } from '../types/index.js'
diff --git a/src/server/cookie-handler.ts b/src/server/cookie-handler.ts
index 1a1bdcd..61432dd 100644
--- a/src/server/cookie-handler.ts
+++ b/src/server/cookie-handler.ts
@@ -1,17 +1,20 @@
-// Import the cookie/request helpers from the narrow `@tanstack/start-server-core`
-// entry, NOT the broad `@tanstack/react-start/server` barrel. The barrel
-// re-exports the SSR render handlers (renderRouterToString → react-dom/server),
-// which, if this module is ever reached from a client-bundled file (e.g. a
-// `start.ts` that registers middleware), would drag server-only render code into
-// the client bundle and break hydration. The narrow entry exposes the same
-// helpers without the renderer. (start-server-core is a direct dependency of
-// @tanstack/react-start, so it is always present.)
+// Import the cookie/request helpers from the `@tanstack/start-server-core/request-response`
+// subpath, NOT the package root or the `@tanstack/react-start/server` barrel that
+// re-exports it. Those roots pull in `createStartHandler`, which references the
+// per-app virtual modules `#tanstack-router-entry` / `#tanstack-start-entry`; when a
+// downstream app pre-bundles this SDK as a dependency (e.g. Vite's dep optimizer),
+// those specifiers cannot be resolved and the consumer's `vite dev`/build fails
+// during dependency optimization. The roots also drag in the SSR renderer
+// (renderRouterToString → react-dom/server), which would bloat a client bundle that
+// transitively reaches this module and break hydration. The `/request-response`
+// subpath exposes the same helpers with neither problem — and start-server-core is a
+// direct dependency of @tanstack/react-start, so it is always present.
 import {
   getCookie,
   getCookies,
   setCookie,
   deleteCookie,
-} from '@tanstack/start-server-core'
+} from '@tanstack/start-server-core/request-response'
 import type {
   CookieHandler,
   CookieSerializeOptions,
diff --git a/src/server/handlers.test.ts b/src/server/handlers.test.ts
index b695de8..0cbd6ee 100644
--- a/src/server/handlers.test.ts
+++ b/src/server/handlers.test.ts
@@ -3,7 +3,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 let currentRequest: Request
 let ambientResponseHeaders: Headers
 
-vi.mock('@tanstack/start-server-core', () => ({
+vi.mock('@tanstack/start-server-core/request-response', () => ({
   getRequest: () => currentRequest,
   getResponseHeaders: () => ambientResponseHeaders,
 }))
diff --git a/src/server/handlers.ts b/src/server/handlers.ts
index 37a0b95..9f9b0fd 100644
--- a/src/server/handlers.ts
+++ b/src/server/handlers.ts
@@ -1,6 +1,8 @@
-// Narrow entry (not the @tanstack/react-start/server barrel) so the SSR render
-// handlers are never pulled into a client-reachable graph. See cookie-handler.ts.
-import { getRequest, getResponseHeaders } from '@tanstack/start-server-core'
+// Import from the `/request-response` subpath, not the package root or the
+// `@tanstack/react-start/server` barrel: the root pulls in createStartHandler's
+// unresolvable virtual modules (which break a consumer's dep-optimizer build) and
+// the SSR renderer. See cookie-handler.ts for the full rationale.
+import { getRequest, getResponseHeaders } from '@tanstack/start-server-core/request-response'
 import type { Auth0Instance } from './auth0-server.js'
 import {
   resolveAppBaseUrl,
diff --git a/src/server/redirect-uri.test.ts b/src/server/redirect-uri.test.ts
index 11269f2..d186895 100644
--- a/src/server/redirect-uri.test.ts
+++ b/src/server/redirect-uri.test.ts
@@ -2,7 +2,7 @@ import { describe, expect, it, vi, beforeEach } from 'vitest'
 
 let currentRequest: Request
 
-vi.mock('@tanstack/start-server-core', () => ({
+vi.mock('@tanstack/start-server-core/request-response', () => ({
   getRequest: () => currentRequest,
 }))
 
diff --git a/src/server/redirect-uri.ts b/src/server/redirect-uri.ts
index 899b65d..a4869d2 100644
--- a/src/server/redirect-uri.ts
+++ b/src/server/redirect-uri.ts
@@ -1,4 +1,4 @@
-import { getRequest } from '@tanstack/start-server-core'
+import { getRequest } from '@tanstack/start-server-core/request-response'
 import type { Auth0Instance } from './auth0-server.js'
 import {
   resolveAppBaseUrl,