diff --git a/Cargo.lock b/Cargo.lock
index b5c56ec..a97ee39 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1858,7 +1858,7 @@ version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8034a681df4aed8b8edbd7fbe472401ecf009251c8b40556b304567052e294c5"
 dependencies = [
- "async-lock 3.4.2",
+ "async-lock",
  "blocking",
  "futures-lite 2.6.1",
 ]
@@ -1872,7 +1872,7 @@ dependencies = [
  "async-channel 2.5.0",
  "async-executor",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "blocking",
  "futures-lite 2.6.1",
  "once_cell",
@@ -1896,15 +1896,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "async-lock"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "287272293e9d8c41773cec55e365490fe034813a2f172f502d6ddcf75b2f582b"
-dependencies = [
- "event-listener 2.5.3",
-]
-
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -1935,7 +1926,7 @@ checksum = "fc50921ec0055cdd8a16de48773bfeec5c972598674347252c0399676be7da75"
 dependencies = [
  "async-channel 2.5.0",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "async-signal",
  "async-task",
  "blocking",
@@ -1963,7 +1954,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "52b5aaafa020cf5053a01f2a60e8ff5dccf550f0f77ec54a4e47285ac2bab485"
 dependencies = [
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "atomic-waker",
  "cfg-if",
  "futures-core",
@@ -1983,14 +1974,14 @@ dependencies = [
  "async-channel 1.9.0",
  "async-global-executor",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "async-process",
  "crossbeam-utils",
  "futures-channel",
  "futures-core",
  "futures-io",
  "futures-lite 2.6.1",
- "gloo-timers 0.3.0",
+ "gloo-timers",
  "kv-log-macro",
  "log",
  "memchr",
@@ -2327,7 +2318,7 @@ dependencies = [
  "bitflags 2.12.1",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.11.0",
  "log",
  "prettyplease",
  "proc-macro2",
@@ -2347,7 +2338,7 @@ dependencies = [
  "bitflags 2.12.1",
  "cexpr",
  "clang-sys",
- "itertools 0.13.0",
+ "itertools 0.11.0",
  "log",
  "prettyplease",
  "proc-macro2",
@@ -3260,7 +3251,7 @@ name = "common"
 version = "0.1.0"
 source = "git+https://github.com/ethereum/kohaku?rev=618c53facd0d44cf0f01d74e0dcc18d2242351c7#618c53facd0d44cf0f01d74e0dcc18d2242351c7"
 dependencies = [
- "gloo-timers 0.3.0",
+ "gloo-timers",
  "tokio",
  "web-time",
 ]
@@ -4305,7 +4296,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users 0.5.2",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4665,7 +4656,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -5300,16 +5291,6 @@ version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
-[[package]]
-name = "futures-timer"
-version = "3.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
-dependencies = [
- "gloo-timers 0.4.0",
- "send_wrapper",
-]
-
 [[package]]
 name = "futures-util"
 version = "0.3.32"
@@ -5618,27 +5599,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "gloo-net"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a66b4e3c7d9ed8d315fd6b97c8b1f74a7c6ecbbc2320e65ae7ed38b7068cc620"
-dependencies = [
- "futures-channel",
- "futures-core",
- "futures-sink",
- "gloo-utils",
- "http 0.2.12",
- "js-sys",
- "pin-project",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "web-sys",
-]
-
 [[package]]
 name = "gloo-timers"
 version = "0.3.0"
@@ -5651,31 +5611,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "gloo-timers"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "482ce8a491a501da4cd806bd190275363d674f2845005c6ddbd5d3e1dd54495d"
-dependencies = [
- "futures-channel",
- "futures-core",
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "gloo-utils"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "037fcb07216cb3a30f7292bd0176b050b7b9a052ba830ef7d5d65f6dc64ba58e"
-dependencies = [
- "js-sys",
- "serde",
- "serde_json",
- "wasm-bindgen",
- "web-sys",
-]
-
 [[package]]
 name = "glow"
 version = "0.17.0"
@@ -6325,7 +6260,7 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 [[package]]
 name = "helios-common"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "async-trait",
@@ -6341,7 +6276,7 @@ dependencies = [
 [[package]]
 name = "helios-consensus-core"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "alloy-rlp",
@@ -6365,7 +6300,7 @@ dependencies = [
 [[package]]
 name = "helios-core"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "alloy-trie",
@@ -6395,7 +6330,7 @@ dependencies = [
 [[package]]
 name = "helios-ethereum"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "alloy-trie",
@@ -6433,7 +6368,7 @@ dependencies = [
 [[package]]
 name = "helios-revm-utils"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "eyre",
@@ -6448,7 +6383,7 @@ dependencies = [
 [[package]]
 name = "helios-verifiable-api-client"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "async-trait",
@@ -6467,7 +6402,7 @@ dependencies = [
 [[package]]
 name = "helios-verifiable-api-types"
 version = "0.11.1"
-source = "git+https://github.com/a16z/helios?tag=0.11.1#204c998a927348e1c000a664f08d5b37b1b0d924"
+source = "git+https://github.com/a16z/helios?rev=43a8c9f3cdda41a6f383c4db41d9a83f102638b1#43a8c9f3cdda41a6f383c4db41d9a83f102638b1"
 dependencies = [
  "alloy",
  "helios-common",
@@ -6707,7 +6642,6 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project-lite",
- "socket2 0.5.10",
  "tokio",
  "tower-service",
  "tracing",
@@ -6735,22 +6669,6 @@ dependencies = [
  "want",
 ]
 
-[[package]]
-name = "hyper-rustls"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
-dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.32",
- "log",
- "rustls 0.21.12",
- "rustls-native-certs 0.6.3",
- "tokio",
- "tokio-rustls 0.24.1",
-]
-
 [[package]]
 name = "hyper-rustls"
 version = "0.27.9"
@@ -6760,10 +6678,10 @@ dependencies = [
  "http 1.4.1",
  "hyper 1.10.1",
  "hyper-util",
- "rustls 0.23.40",
- "rustls-native-certs 0.8.4",
+ "rustls",
+ "rustls-native-certs",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tower-service",
 ]
 
@@ -6800,12 +6718,12 @@ dependencies = [
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.4",
+ "socket2",
  "system-configuration 0.7.0",
  "tokio",
  "tower-service",
  "tracing",
- "windows-registry 0.6.1",
+ "windows-registry 0.4.0",
 ]
 
 [[package]]
@@ -6820,7 +6738,7 @@ dependencies = [
  "js-sys",
  "log",
  "wasm-bindgen",
- "windows-core 0.62.2",
+ "windows-core 0.57.0",
 ]
 
 [[package]]
@@ -7162,7 +7080,7 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4d40460c0ce33d6ce4b0630ad68ff63d6661961c48b6dba35e5a4d81cfb48222"
 dependencies = [
- "socket2 0.6.4",
+ "socket2",
  "widestring",
  "windows-registry 0.6.1",
  "windows-result 0.4.1",
@@ -7318,37 +7236,11 @@ version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5f3783308bddc49d0218307f66a09330c106fbd792c58bac5c8dc294fdd0f98"
 dependencies = [
- "jsonrpsee-client-transport",
  "jsonrpsee-core",
- "jsonrpsee-http-client",
  "jsonrpsee-proc-macros",
  "jsonrpsee-server",
  "jsonrpsee-types",
- "jsonrpsee-wasm-client",
- "jsonrpsee-ws-client",
- "tracing",
-]
-
-[[package]]
-name = "jsonrpsee-client-transport"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "abc5630e4fa0096f00ec7b44d520701fda4504170cb85e22dca603ae5d7ad0d7"
-dependencies = [
- "futures-channel",
- "futures-util",
- "gloo-net",
- "http 0.2.12",
- "jsonrpsee-core",
- "pin-project",
- "rustls-native-certs 0.6.3",
- "soketto",
- "thiserror 1.0.69",
- "tokio",
- "tokio-rustls 0.24.1",
- "tokio-util",
  "tracing",
- "webpki-roots",
 ]
 
 [[package]]
@@ -7358,10 +7250,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5aaa4c4d5fb801dcc316d81f76422db259809037a86b3194ae538dd026b05ed7"
 dependencies = [
  "anyhow",
- "async-lock 2.8.0",
  "async-trait",
  "beef",
- "futures-timer",
  "futures-util",
  "globset",
  "hyper 0.14.32",
@@ -7374,27 +7264,6 @@ dependencies = [
  "soketto",
  "thiserror 1.0.69",
  "tokio",
- "tokio-stream",
- "tracing",
- "wasm-bindgen-futures",
-]
-
-[[package]]
-name = "jsonrpsee-http-client"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa7165efcbfbc951d180162ff28fe91b657ed81925e37a35e4a396ce12109f96"
-dependencies = [
- "async-trait",
- "hyper 0.14.32",
- "hyper-rustls 0.24.2",
- "jsonrpsee-core",
- "jsonrpsee-types",
- "serde",
- "serde_json",
- "thiserror 1.0.69",
- "tokio",
- "tower 0.4.13",
  "tracing",
 ]
 
@@ -7445,29 +7314,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "jsonrpsee-wasm-client"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fe953c2801356f214d3f4051f786b3d11134512a46763ee8c39a9e3fa2cc1c0"
-dependencies = [
- "jsonrpsee-client-transport",
- "jsonrpsee-core",
- "jsonrpsee-types",
-]
-
-[[package]]
-name = "jsonrpsee-ws-client"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5c71b2597ec1c958c6d5bc94bb61b44d74eb28e69dc421731ab0035706f13882"
-dependencies = [
- "http 0.2.12",
- "jsonrpsee-client-transport",
- "jsonrpsee-core",
- "jsonrpsee-types",
-]
-
 [[package]]
 name = "k256"
 version = "0.13.4"
@@ -8283,10 +8129,10 @@ dependencies = [
  "libc",
  "log",
  "openssl",
- "openssl-probe 0.2.1",
+ "openssl-probe",
  "openssl-sys",
  "schannel",
- "security-framework 3.7.0",
+ "security-framework",
  "security-framework-sys",
  "tempfile",
 ]
@@ -8417,7 +8263,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -8566,7 +8412,7 @@ version = "0.7.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
 dependencies = [
- "proc-macro-crate 3.5.0",
+ "proc-macro-crate 2.0.0",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
@@ -8933,7 +8779,7 @@ dependencies = [
  "ashpd",
  "async-fs",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "blocking",
  "cbc",
  "cipher",
@@ -9014,12 +8860,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "openssl-probe"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
-
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
@@ -9917,8 +9757,8 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash 2.1.2",
- "rustls 0.23.40",
- "socket2 0.6.4",
+ "rustls",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -9938,7 +9778,7 @@ dependencies = [
  "rand 0.9.4",
  "ring",
  "rustc-hash 2.1.2",
- "rustls 0.23.40",
+ "rustls",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.18",
@@ -9956,9 +9796,9 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.4",
+ "socket2",
  "tracing",
- "windows-sys 0.60.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -10016,7 +9856,7 @@ dependencies = [
  "futures",
  "getrandom 0.2.17",
  "getrandom 0.3.4",
- "gloo-timers 0.3.0",
+ "gloo-timers",
  "hex",
  "js-sys",
  "num-bigint",
@@ -10391,7 +10231,7 @@ dependencies = [
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls",
  "hyper-tls",
  "hyper-util",
  "js-sys",
@@ -10430,21 +10270,21 @@ dependencies = [
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.40",
+ "rustls",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
  "serde_json",
  "sync_wrapper",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tower 0.5.3",
  "tower-http",
  "tower-service",
@@ -11063,19 +10903,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
-]
-
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -11088,42 +10916,21 @@ dependencies = [
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.13",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
-[[package]]
-name = "rustls-native-certs"
-version = "0.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
-dependencies = [
- "openssl-probe 0.1.6",
- "rustls-pemfile 1.0.4",
- "schannel",
- "security-framework 2.11.1",
-]
-
 [[package]]
 name = "rustls-native-certs"
 version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dab5152771c58876a2146916e53e35057e1a4dfa2b9df0f0305b07f611fdea4d"
 dependencies = [
- "openssl-probe 0.2.1",
+ "openssl-probe",
  "rustls-pki-types",
  "schannel",
- "security-framework 3.7.0",
-]
-
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
+ "security-framework",
 ]
 
 [[package]]
@@ -11156,14 +10963,14 @@ dependencies = [
  "jni",
  "log",
  "once_cell",
- "rustls 0.23.40",
- "rustls-native-certs 0.8.4",
+ "rustls",
+ "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.13",
- "security-framework 3.7.0",
+ "rustls-webpki",
+ "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -11172,16 +10979,6 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
-[[package]]
-name = "rustls-webpki"
-version = "0.101.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "rustls-webpki"
 version = "0.103.13"
@@ -11383,16 +11180,6 @@ dependencies = [
  "once_cell",
 ]
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "seahash"
 version = "4.1.0"
@@ -11455,19 +11242,6 @@ dependencies = [
  "cc",
 ]
 
-[[package]]
-name = "security-framework"
-version = "2.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
-dependencies = [
- "bitflags 2.12.1",
- "core-foundation 0.9.4",
- "core-foundation-sys",
- "libc",
- "security-framework-sys",
-]
-
 [[package]]
 name = "security-framework"
 version = "3.7.0"
@@ -11525,12 +11299,6 @@ dependencies = [
  "pest",
 ]
 
-[[package]]
-name = "send_wrapper"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd0b0ec5f1c1ca621c432a25813d8d60c88abe6d3e08a3eb9cf37d97a0fe3d73"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -11954,7 +11722,7 @@ dependencies = [
  "async-executor",
  "async-fs",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "async-net",
  "async-process",
  "blocking",
@@ -11971,16 +11739,6 @@ dependencies = [
  "serde_core",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.4"
@@ -12535,7 +12293,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -12732,7 +12490,7 @@ dependencies = [
  "mio",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.4",
+ "socket2",
  "tokio-macros",
  "windows-sys 0.61.2",
 ]
@@ -12758,23 +12516,13 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.40",
+ "rustls",
  "tokio",
 ]
 
@@ -12936,10 +12684,6 @@ version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
 dependencies = [
- "futures-core",
- "futures-util",
- "pin-project",
- "pin-project-lite",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -14029,15 +13773,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
-dependencies = [
- "rustls-webpki 0.101.7",
-]
-
 [[package]]
 name = "weezl"
 version = "0.1.12"
@@ -14244,7 +13979,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -14569,15 +14304,6 @@ dependencies = [
  "windows-targets 0.52.6",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2f500e4d28234f72040990ec9d39e3a6b950f9f22d3dba18416c35882612bcb"
-dependencies = [
- "windows-targets 0.53.5",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.61.2"
@@ -15089,7 +14815,7 @@ dependencies = [
  "async-broadcast",
  "async-executor",
  "async-io",
- "async-lock 3.4.2",
+ "async-lock",
  "async-process",
  "async-recursion",
  "async-task",
@@ -15231,7 +14957,7 @@ dependencies = [
  "http-body 1.0.1",
  "http-body-util",
  "hyper 1.10.1",
- "hyper-rustls 0.27.9",
+ "hyper-rustls",
  "hyper-util",
  "ipnet",
  "js-sys",
@@ -15242,9 +14968,9 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.40",
- "rustls-native-certs 0.8.4",
- "rustls-pemfile 2.2.0",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-pemfile",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -15252,7 +14978,7 @@ dependencies = [
  "sync_wrapper",
  "system-configuration 0.6.1",
  "tokio",
- "tokio-rustls 0.26.4",
+ "tokio-rustls",
  "tokio-socks",
  "tokio-util",
  "tower 0.5.3",
diff --git a/crates/deckard-core/Cargo.toml b/crates/deckard-core/Cargo.toml
index 1eeb908..89cde38 100644
--- a/crates/deckard-core/Cargo.toml
+++ b/crates/deckard-core/Cargo.toml
@@ -57,12 +57,13 @@ reqwest = { version = "0.12", default-features = false, features = ["json"], opt
 serde = { version = "1", features = ["derive"], optional = true }
 serde_json = { version = "1", optional = true }
 
-# Embedded Helios light client (verified localhost JSON-RPC server). Git-only, tag
-# "0.11.1" (crates.io is stale at 0.1.0); the umbrella `helios` crate pulls a yanked
-# core2, so depend on `helios-ethereum` directly. Heavy (revm/bls12_381) — gated
-# behind `verified-reads`. The `ethereum_hashing` patch it needs is at the workspace
-# root (a git-dep can't carry its own `[patch]`).
-helios-ethereum = { git = "https://github.com/a16z/helios", tag = "0.11.1", optional = true }
+# Embedded Helios light client (verified localhost JSON-RPC server). Git-only,
+# pinned past 0.11.1 because a16z/helios#804 disables unused jsonrpsee client
+# transports that otherwise leak into downstream security reports. The umbrella
+# `helios` crate pulls a yanked core2, so depend on `helios-ethereum` directly.
+# Heavy (revm/bls12_381) — gated behind `verified-reads`. The `ethereum_hashing`
+# patch it needs is at the workspace root (a git-dep can't carry its own `[patch]`).
+helios-ethereum = { git = "https://github.com/a16z/helios", rev = "43a8c9f3cdda41a6f383c4db41d9a83f102638b1", optional = true }
 
 # Kohaku's pure-Rust Railgun client — the heavy ZK crate. Gated behind `shield` (DEFAULT
 # ON). We use ONLY the key-less `ShieldBuilder` (no sync, no proving, no key), but the crate
diff --git a/deny.toml b/deny.toml
index d8f6e06..354c1cf 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,23 +29,16 @@ all-features = true
 # strict (not assume "a security yank always carries a RUSTSEC advisory") because a security-motivated
 # yank can PRECEDE its advisory. Add to `ignore` ONLY with a written justification. (#82)
 #
-# Every entry below is a TRANSITIVE advisory with NO in-tree fix; removing them is tracked in #40.
+# Every entry below is a TRANSITIVE advisory with NO in-tree fix; removing them is tracked in #40/#51.
 # Re-evaluate the whole list on each `just bump-gpui` / Helios / alloy bump — drop any that resolve.
 yanked = "deny"
 ignore = [
-    # ── rustls-webpki 0.101 — TLS path-validation advisories, reachable only through the Helios
-    #    light client's jsonrpsee 0.19 → rustls 0.21 stack. rustls 0.21 caps webpki at 0.101, so
-    #    there is no in-tree upgrade; the fix is bumping Helios → newer jsonrpsee/rustls (#40).
-    #    Mitigating: custody never rests on TLS — Helios proof-checks every read against the sync
-    #    committee, signing is local, and a signed tx is self-authenticating.
-    { id = "RUSTSEC-2026-0098", reason = "rustls-webpki URI name-constraint bypass; transitive via Helios/jsonrpsee, no in-tree fix; tracked in #40" },
-    { id = "RUSTSEC-2026-0099", reason = "rustls-webpki wildcard-cert name-constraint bypass; transitive via Helios/jsonrpsee, no in-tree fix; tracked in #40" },
-    { id = "RUSTSEC-2026-0104", reason = "rustls-webpki CRL-parsing panic; we do not use CRLs (not reachable); transitive via Helios/jsonrpsee; tracked in #40" },
     # ── hickory DNS — DoS advisories, reachable only on hostile DNS responses during RPC name
-    #    resolution. CPU-exhaustion (liveness), not a custody risk. Transitive via reqwest; the fix
-    #    rides the same Helios/reqwest modernization (#40).
-    { id = "RUSTSEC-2026-0118", reason = "hickory NSEC3 unbounded-loop DoS; transitive via reqwest resolver; liveness-only; tracked in #40" },
-    { id = "RUSTSEC-2026-0119", reason = "hickory O(n^2) name-compression CPU-exhaustion DoS; transitive via reqwest resolver; liveness-only; tracked in #40" },
+    #    resolution. CPU-exhaustion (liveness), not a custody risk. Transitive via Helios'
+    #    reqwest resolver; the remaining fix needs upstream Helios to gate or update
+    #    `reqwest/hickory-dns` (#51).
+    { id = "RUSTSEC-2026-0118", reason = "hickory NSEC3 unbounded-loop DoS; transitive via Helios reqwest resolver; liveness-only; tracked in #51" },
+    { id = "RUSTSEC-2026-0119", reason = "hickory O(n^2) name-compression CPU-exhaustion DoS; transitive via Helios reqwest resolver; liveness-only; tracked in #51" },
     # ── Unmaintained crates. All transitive with no maintained drop-in in the pinned tree; the
     #    proc-macro / build-time ones never ship in the runtime binary → zero runtime attack surface.
     { id = "RUSTSEC-2024-0370", reason = "proc-macro-error unmaintained; build-time only (GTK tray stack), no runtime surface" },
diff --git a/execplans/helios-jsonrpsee-main-upgrade.md b/execplans/helios-jsonrpsee-main-upgrade.md
new file mode 100644
index 0000000..61ec336
--- /dev/null
+++ b/execplans/helios-jsonrpsee-main-upgrade.md
@@ -0,0 +1,109 @@
+# Helios Jsonrpsee Main Upgrade
+
+## 1. Title
+
+Helios Jsonrpsee Main Upgrade
+
+## 2. Context
+
+- Discovery and dependency-security work for Deckard's verified-read path.
+- User asked whether a merged upstream Helios change that disables unused `jsonrpsee`
+  packages unblocks Deckard from security notifications or local dependency comments.
+- Affects `deckard-core`'s optional `verified-reads` dependency on `helios-ethereum`.
+
+## 3. Source Of Truth
+
+- User request in this workspace.
+- Repo guidance: `AGENTS.md`, `/Users/hellno/.codex/RTK.md`, `PLANS.md`.
+- External upstream: a16z/helios PR #804 and current `master` ref.
+- Relevant code files: `crates/deckard-core/Cargo.toml`, `Cargo.lock`.
+
+## 4. Current State Analysis
+
+- Deckard pins `helios-ethereum` to tag `0.11.1` (`204c998a`).
+- That Helios tag enables `jsonrpsee = { version = "0.19.0", features = ["full"] }`
+  in `helios-core`, which pulls unused HTTP, WebSocket, and WASM client transport crates.
+- Upstream PR #804 was merged after the tag and narrows Helios `jsonrpsee` features to
+  `server`, `macros`, and `client-core`.
+
+## 5. Target State
+
+- Determine whether pinning Deckard to current Helios `master` compiles.
+- Confirm whether the unused `jsonrpsee` transport crates leave the active Deckard graph.
+- Do not change runtime behavior or verified-read trust labels.
+
+## 6. Security And Trust Invariants
+
+- No key material, seed phrases, passphrases, decrypted keystore data, or RPC secrets are logged,
+  printed, or written to artifacts.
+- Verified reads must continue to be tagged by `ReadStatus`; unverified reads are never displayed
+  as verified.
+- This dependency test must not add decrypt/sign capability to key-less crates.
+
+## 7. UX And Design Constraints
+
+- No UI work.
+
+## 8. Execution Plan
+
+1. Verify upstream Helios PR/ref and current Deckard pin.
+2. Update `helios-ethereum` from tag `0.11.1` to current upstream commit for a local test.
+3. Refresh `Cargo.lock`.
+4. Inspect dependency graph for removed `jsonrpsee` transports and old `rustls-webpki`.
+5. Run focused and required validation as time permits, recording failures honestly.
+
+## 9. Validation Criteria
+
+Default Deckard Definition of Done:
+
+```text
+cargo fmt --all --check
+just check
+cargo test --workspace
+```
+
+Task-specific checks:
+
+- `cargo update -p helios-ethereum`
+- Dependency graph checks for `jsonrpsee-http-client`, `jsonrpsee-ws-client`,
+  `jsonrpsee-wasm-client`, and `rustls-webpki 0.101`.
+- At least a focused `deckard-core` check with `verified-reads`.
+
+## 10. Failure Signals
+
+- Deckard no longer compiles against Helios `master`.
+- Removed client transports remain in the active dependency graph solely because of Helios.
+- Lockfile gains unrelated dependency churn.
+
+## 11. Risks And Tradeoffs
+
+- Helios `master` is not a release tag, so a production pin should use an explicit commit and
+  may still need a comment explaining why this is intentionally not tag `0.11.1`.
+- Full DoD can be expensive because GPUI and ZK dependencies are large.
+
+## 12. Out Of Scope
+
+- Changing Helios runtime behavior.
+- Solving unrelated advisories such as optional DNS resolver features unless the graph proves they
+  are affected by this bump.
+
+## 13. Status Notes
+
+- 2026-06-23: Created plan after confirming upstream PR #804 and current branch hygiene.
+- 2026-06-23: Pinned `helios-ethereum` to a16z/helios `43a8c9f3`; Cargo removed
+  `jsonrpsee-http-client`, `jsonrpsee-ws-client`, `jsonrpsee-wasm-client`,
+  `jsonrpsee-client-transport`, `hyper-rustls 0.24`, `rustls 0.21`, and
+  `rustls-webpki 0.101`.
+- 2026-06-23: `cargo tree` confirms active `jsonrpsee` features are only `server`,
+  `macros`, and `client-core`; the old `jsonrpsee` client transport packages no longer
+  match package ID lookups.
+- 2026-06-23: `cargo deny check advisories` reported the three `rustls-webpki`
+  ignores as unused, so `deny.toml` now drops them. The Hickory DNS ignores remain
+  because Helios still enables `reqwest/hickory-dns`.
+- 2026-06-23: Validation green:
+  `cargo fmt --all --check`; `cargo check -p deckard-core --features verified-reads`;
+  `just core`; `just check`; `cargo deny check advisories`;
+  `TMPDIR=/tmp cargo test --workspace`.
+- 2026-06-23: Plain `cargo test --workspace` failed once on macOS because the default
+  `/var/folders/...` temp path made a test Unix socket exceed `SUN_LEN`; the exact test
+  passed with `TMPDIR=/tmp`, as did the full workspace test run.