diff --git a/Cargo.lock b/Cargo.lock
index 4fc0e63fd..36c37312b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -363,10 +363,10 @@ dependencies = [
  "serde_json",
  "serde_path_to_error",
  "serde_urlencoded",
- "sha1",
+ "sha1 0.10.6",
  "sync_wrapper",
  "tokio",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.29.0",
  "tower",
  "tower-layer",
  "tower-service",
@@ -733,6 +733,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "chromiumoxide"
 version = "0.9.1"
@@ -915,7 +926,7 @@ dependencies = [
  "tempfile",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.30.0",
  "toml_edit 0.25.12+spec-1.1.0",
  "tower",
  "tracing",
@@ -1051,7 +1062,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tokio-socks",
- "tokio-tungstenite",
+ "tokio-tungstenite 0.30.0",
  "tracing",
  "webpki-roots 1.0.8",
  "zstd",
@@ -4469,6 +4480,17 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -5284,6 +5306,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha1"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
@@ -6304,6 +6337,18 @@ name = "tokio-tungstenite"
 version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f72a05e828585856dacd553fba484c242c46e391fb0e58917c942ee9202915c"
+dependencies = [
+ "futures-util",
+ "log",
+ "tokio",
+ "tungstenite 0.29.0",
+]
+
+[[package]]
+name = "tokio-tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17a073bfed563fa236697a068031408a93cd9522e08abf9933ead3e73411bd71"
 dependencies = [
  "futures-util",
  "log",
@@ -6311,7 +6356,7 @@ dependencies = [
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
- "tungstenite 0.29.0",
+ "tungstenite 0.30.0",
  "webpki-roots 0.26.11",
 ]
 
@@ -6613,7 +6658,7 @@ dependencies = [
  "httparse",
  "log",
  "rand 0.9.4",
- "sha1",
+ "sha1 0.10.6",
  "thiserror 2.0.18",
  "utf-8",
 ]
@@ -6630,9 +6675,25 @@ dependencies = [
  "httparse",
  "log",
  "rand 0.9.4",
+ "sha1 0.10.6",
+ "thiserror 2.0.18",
+]
+
+[[package]]
+name = "tungstenite"
+version = "0.30.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e48ac77174b19c110a50ab2128b24215ac9cb40e0e12e093fb602d175c569d22"
+dependencies = [
+ "bytes",
+ "data-encoding",
+ "http",
+ "httparse",
+ "log",
+ "rand 0.10.2",
  "rustls",
  "rustls-pki-types",
- "sha1",
+ "sha1 0.11.0",
  "thiserror 2.0.18",
 ]
 
diff --git a/crates/proxy/Cargo.toml b/crates/proxy/Cargo.toml
index 38a39f527..a86d08958 100644
--- a/crates/proxy/Cargo.toml
+++ b/crates/proxy/Cargo.toml
@@ -39,7 +39,7 @@ reqwest-websocket = "0.6"
 # TLS / 握手全自管(TLS 走 tokio-rustls,见 ws_passthrough.rs),不用 tokio-tungstenite 自带 TLS,
 # 故无需 TLS feature。remote-control 仍用 reqwest-websocket。[followup MOC-239] 该 relay 默认禁用
 # (上游 ALB WS 实证不可达),保留待验证。
-tokio-tungstenite = "0.29"
+tokio-tungstenite = "0.30"
 # [MOC-234] 经 VPN 代理建上游 WS 隧道走 SOCKS5(proxy 端解析域名,绕开客户端 fake-ip)。
 tokio-socks = "0.5"
 # [MOC-234] rustls 0.23 进程级 CryptoProvider:依赖树有多个 backend 候选时无法自动选,做 TLS
@@ -57,7 +57,7 @@ base64 = "0.22"
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }
 indexmap = "2"
-tokio-tungstenite = "0.29"
+tokio-tungstenite = "0.30"
 tempfile = "3"
 # [MOC-195] 集成测试 main 前隔离 home(tests/common/mod.rs),版本跟 lock 内既有传递依赖一致
 ctor = "1.0"
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 3c7e4b8fb..4fe1ed4f3 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -75,7 +75,7 @@ flate2 = "1.0"
 # fs2-0.4.3/src/unix.rs)/ Windows 走 LockFileEx,OS 级独占。
 fs2 = "0.4"
 # CDP WebSocket 连接（Codex Plugins 解锁器）
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+tokio-tungstenite = { version = "0.30", features = ["rustls-tls-webpki-roots"] }
 # futures 用于 WebSocket Stream/Sink 的 split 操作
 futures = "0.3"
 # 诊断流量查看器(MOC-169)SSE:把 trace_store 的 broadcast::Receiver 适配成 axum Sse Stream