diff --git a/.busbar-ref b/.busbar-ref
index 4d142b1..a388fd8 100644
--- a/.busbar-ref
+++ b/.busbar-ref
@@ -1 +1 @@
-4e9b306af100d3f7e59f4320252068ea8067ac70 1.6.0
+163843dd2c59cd5a1181bdeed078f75dc6bdef97 1.6.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c186829..b4e3f32 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ permissions:
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@4e9b306af100d3f7e59f4320252068ea8067ac70
+    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@163843dd2c59cd5a1181bdeed078f75dc6bdef97
     with:
       service: none
       busbar_checkout: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f941f3e..5263322 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
     secrets: inherit
   release:
     needs: ci
-    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@4e9b306af100d3f7e59f4320252068ea8067ac70
+    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@163843dd2c59cd5a1181bdeed078f75dc6bdef97
     with:
       plugin_crate: busbar-store-memory-plugin
       manifest_name: busbar-store-memory
@@ -41,7 +41,7 @@ jobs:
   consumer-verify:
     needs: release
     if: ${{ !cancelled() }}
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@4e9b306af100d3f7e59f4320252068ea8067ac70
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@163843dd2c59cd5a1181bdeed078f75dc6bdef97
     with:
       version: ${{ github.ref_name }}
       asset_prefix: busbar-store-memory
diff --git a/.github/workflows/repin.yml b/.github/workflows/repin.yml
index d911660..d3b1c28 100644
--- a/.github/workflows/repin.yml
+++ b/.github/workflows/repin.yml
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   repin:
-    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@4e9b306af100d3f7e59f4320252068ea8067ac70
+    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@163843dd2c59cd5a1181bdeed078f75dc6bdef97
     with:
       busbar_sha: ${{ github.event.client_payload.sha || inputs.busbar_sha }}
       busbar_version: ${{ github.event.client_payload.version || inputs.busbar_version }}
diff --git a/Cargo.lock b/Cargo.lock
index 6e2e039..1d3fd87 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -43,7 +43,7 @@ dependencies = [
 [[package]]
 name = "busbar-contract"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=4e9b306af100d3f7e59f4320252068ea8067ac70#4e9b306af100d3f7e59f4320252068ea8067ac70"
+source = "git+https://github.com/GetBusbar/busbar?rev=163843dd2c59cd5a1181bdeed078f75dc6bdef97#163843dd2c59cd5a1181bdeed078f75dc6bdef97"
 dependencies = [
  "async-trait",
  "base64",
@@ -66,7 +66,7 @@ dependencies = [
 [[package]]
 name = "busbar-plugin-loader"
 version = "1.5.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=4e9b306af100d3f7e59f4320252068ea8067ac70#4e9b306af100d3f7e59f4320252068ea8067ac70"
+source = "git+https://github.com/GetBusbar/busbar?rev=163843dd2c59cd5a1181bdeed078f75dc6bdef97#163843dd2c59cd5a1181bdeed078f75dc6bdef97"
 dependencies = [
  "busbar-contract",
  "ed25519-dalek",
diff --git a/Cargo.toml b/Cargo.toml
index ee0200c..85c93de 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,8 +10,8 @@
 # `.busbar-ref`; no sibling-checkout path dependency ships in any manifest.
 #
 # THIRD-PARTY VERSIONS ARE THE FLEET'S, NOT THIS REPO'S. The table below is busbar's own root
-# `[workspace.dependencies]` (third-party rows) at busbar 4e9b306af100d3f7e59f4320252068ea8067ac70, followed by the plugin-only rows
-# of busbar's `.github/fleet/deps.toml` at 4e9b306af100d3f7e59f4320252068ea8067ac70. A member takes a crate with
+# `[workspace.dependencies]` (third-party rows) at busbar 163843dd2c59cd5a1181bdeed078f75dc6bdef97, followed by the plugin-only rows
+# of busbar's `.github/fleet/deps.toml` at 163843dd2c59cd5a1181bdeed078f75dc6bdef97. A member takes a crate with
 # `{ workspace = true }` (adding features if it needs them); a crate in neither table is a new
 # `deps.toml` row in busbar first. CI holds this repo's Cargo.lock to busbar's lock at the pin.
 [workspace]
@@ -29,11 +29,12 @@ publish = false
 repository = "https://github.com/GetBusbar/busbar-store-memory"
 
 [workspace.dependencies]
-busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "4e9b306af100d3f7e59f4320252068ea8067ac70" }
-busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "4e9b306af100d3f7e59f4320252068ea8067ac70" }
-# busbar's root [workspace.dependencies], third-party rows, at 4e9b306af100d3f7e59f4320252068ea8067ac70
+busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "163843dd2c59cd5a1181bdeed078f75dc6bdef97" }
+busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "163843dd2c59cd5a1181bdeed078f75dc6bdef97" }
+# busbar's root [workspace.dependencies], third-party rows, at 163843dd2c59cd5a1181bdeed078f75dc6bdef97
 a2a-lf = "0.3.0"
 a2a-pb = "0.2.0"
+aes = { version = "0.8", default-features = false }
 arc-swap = "1"
 async-trait = "0.1"
 axum = "0.8"
@@ -86,6 +87,7 @@ sha2 = "0.10"
 smallvec = "1"
 socket2 = { version = "0.6", features = ["all"] }
 sonic-rs = "0.5"
+str0m = { version = "=0.24.1", default-features = false }
 syn = { version = "2", features = ["full", "visit", "parsing", "printing"] }
 tar = { version = "0.4", default-features = false }
 tikv-jemalloc-ctl = "0.6"
@@ -106,7 +108,7 @@ url = "2"
 webpki = { package = "rustls-webpki", version = "0.103", default-features = false, features = ["std", "ring"] }
 webpki-roots = "1"
 zeroize = "1"
-# busbar .github/fleet/deps.toml [plugin-deps], at 4e9b306af100d3f7e59f4320252068ea8067ac70
+# busbar .github/fleet/deps.toml [plugin-deps], at 163843dd2c59cd5a1181bdeed078f75dc6bdef97
 fallible-iterator = "0.2"
 ldap3 = { version = "0.12", default-features = false, features = ["sync"] }
 mysql = { version = "28", default-features = false, features = ["minimal-rust"] }
diff --git a/deny.toml b/deny.toml
index 9e92804..6ad260a 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,5 +1,5 @@
 # RENDERED by `busbar-release plugin heal` from GetBusbar/busbar-release template/ and busbar's
-# `.github/fleet/deps.toml` at 4e9b306af100d3f7e59f4320252068ea8067ac70; a hand edit is overwritten by the next sync. CI runs
+# `.github/fleet/deps.toml` at 163843dd2c59cd5a1181bdeed078f75dc6bdef97; a hand edit is overwritten by the next sync. CI runs
 # `cargo deny check` on it (busbar's plugin-ci.yml at the pin). The license allowlist is busbar's own;
 # the one reviewed git source is busbar itself, at the pin.
 [graph]
@@ -7,6 +7,15 @@ all-features = false
 
 [advisories]
 version = 2
+ignore = [
+    # RUSTSEC-2024-0449: `unsafe-libyaml` 0.2.11 is unmaintained. It reaches this plugin only through
+    # busbar-contract at the pin (busbar-contract -> serde_yaml_ng 0.10 -> unsafe-libyaml), the same
+    # line busbar's own Cargo.lock carries, and busbar's own deny.toml accepts it with this reason:
+    # "unmaintained", not a security hole, and no safe swap exists now (a different YAML parser
+    # risks 1.5.5 config-parse parity). Re-evaluate with busbar's row when serde_yaml_ng moves off
+    # unsafe-libyaml. Tracking: https://rustsec.org/advisories/RUSTSEC-2024-0449.html
+    "RUSTSEC-2024-0449",
+]
 
 [licenses]
 version = 2
@@ -56,6 +65,8 @@ deny = [
     { crate = "a2a-lf:>=0.4.0", reason = "busbar resolves a2a-lf to 0.3.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "a2a-pb:<0.2.0", reason = "busbar resolves a2a-pb to 0.2.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "a2a-pb:>=0.3.0", reason = "busbar resolves a2a-pb to 0.2.0; a plugin may not pull a second version (OWNER 2026-10-02)" },
+    { crate = "aes:<0.8.0", reason = "busbar resolves aes to 0.8.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
+    { crate = "aes:>=0.9.0", reason = "busbar resolves aes to 0.8.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "arc-swap:<1.0.0", reason = "busbar resolves arc-swap to 1.9.2; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "arc-swap:>=2.0.0", reason = "busbar resolves arc-swap to 1.9.2; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "async-trait:<0.1.0", reason = "busbar resolves async-trait to 0.1.92; a plugin may not pull a second version (OWNER 2026-10-02)" },
@@ -160,6 +171,8 @@ deny = [
     { crate = "socket2:>=0.7.0", reason = "busbar resolves socket2 to 0.6.4; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "sonic-rs:<0.5.0", reason = "busbar resolves sonic-rs to 0.5.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "sonic-rs:>=0.6.0", reason = "busbar resolves sonic-rs to 0.5.10; a plugin may not pull a second version (OWNER 2026-10-02)" },
+    { crate = "str0m:<0.24.0", reason = "busbar resolves str0m to 0.24.1; a plugin may not pull a second version (OWNER 2026-10-02)" },
+    { crate = "str0m:>=0.25.0", reason = "busbar resolves str0m to 0.24.1; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "syn:<2.0.0", reason = "busbar resolves syn to 2.0.117, 3.0.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "syn:>=4.0.0", reason = "busbar resolves syn to 2.0.117, 3.0.3; a plugin may not pull a second version (OWNER 2026-10-02)" },
     { crate = "tar:<0.4.0", reason = "busbar resolves tar to 0.4.46; a plugin may not pull a second version (OWNER 2026-10-02)" },