diff --git a/.github/workflows/beta.yml b/.github/workflows/beta.yml
index 13c9b66ea..8208b20c9 100644
--- a/.github/workflows/beta.yml
+++ b/.github/workflows/beta.yml
@@ -28,7 +28,7 @@ jobs:
     continue-on-error: true
     steps:
       - run: rustup toolchain install --profile=minimal beta
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just toolchain=beta fetch
       - run: just toolchain=beta build
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 2085ee4bb..201b3bcbc 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -23,7 +23,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - id: changed
         uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
         with:
@@ -48,7 +48,7 @@ jobs:
     env:
       CXX: "/usr/bin/clang++-19"
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0
       - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --no-run
       - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --skip-clean --ignore-tests --no-fail-fast --out=Xml
diff --git a/.github/workflows/fuzzers.yml b/.github/workflows/fuzzers.yml
index 0ef272138..d32573be5 100644
--- a/.github/workflows/fuzzers.yml
+++ b/.github/workflows/fuzzers.yml
@@ -30,7 +30,7 @@ jobs:
     container: docker://rust:1.88.0
     steps:
       - run: apt update && apt install -y jo
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
         id: changed-files
@@ -55,7 +55,7 @@ jobs:
     steps:
       - run: rustup toolchain add nightly
       - run: cargo install cargo-fuzz
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - working-directory: ${{matrix.dir}}
         run: cargo +nightly fetch
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
index 4cf3c2db9..ce1e2b5b2 100644
--- a/.github/workflows/markdown.yml
+++ b/.github/workflows/markdown.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: DavidAnson/markdownlint-cli2-action@992badcdf24e3b8eb7e87ff9287fe931bcb00c6e
         with:
             globs: "**/*.md"
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 14bad913c..5d114eafd 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -28,7 +28,7 @@ jobs:
     continue-on-error: true
     steps:
       - run: rustup toolchain install --profile=minimal nightly
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: just toolchain=nightly fetch
       - run: just toolchain=nightly profile=release build
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9e80da47c..142342069 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -16,7 +16,7 @@ jobs:
     timeout-minutes: 5
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - id: build
         uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
         with:
@@ -77,7 +77,7 @@ jobs:
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
       - uses: linkerd/dev/actions/setup-tools@v47
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just action-lint
       - run: just action-dev-check
 
@@ -91,7 +91,7 @@ jobs:
     timeout-minutes: 20
     steps:
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0
       - run: just fetch
       - run: cargo deny --all-features check bans licenses sources
@@ -114,7 +114,7 @@ jobs:
         crate: ${{ fromJson(needs.meta.outputs.cargo_crates) }}
     steps:
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0
       - run: just fetch
       - run: just check-crate ${{ matrix.crate }}
@@ -136,7 +136,7 @@ jobs:
           tag=$(linkerd version --client --short)
           echo "linkerd $tag"
           echo "LINKERD_TAG=$tag" >> "$GITHUB_ENV"
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just docker
       - run: just k3d-create
       - run: just k3d-load-linkerd
@@ -168,7 +168,7 @@ jobs:
         if: contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')
         run: exit 1
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         if: needs.meta.outputs.is_dependabot == 'true' && needs.meta.outputs.any_changed == 'true'
       - name: "Merge dependabot changes"
         if: needs.meta.outputs.is_dependabot == 'true' && needs.meta.outputs.any_changed == 'true'
diff --git a/.github/workflows/release-weekly.yml b/.github/workflows/release-weekly.yml
index 562e5eefa..9119f22f9 100644
--- a/.github/workflows/release-weekly.yml
+++ b/.github/workflows/release-weekly.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - name: Check if the most recent commit is after the last release
         id: recency
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a7186612a..43a243932 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,7 +61,23 @@ jobs:
     timeout-minutes: 5
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
-      - id: meta
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        if: github.event_name == 'pull_request'
+      - id: workflow
+        if: github.event_name == 'pull_request'
+        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
+        with:
+          files: |
+            .github/workflows/release.yml
+      - id: build
+        if: github.event_name == 'pull_request'
+        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
+        with:
+          files: |
+            justfile
+            Cargo.toml
+
+      - id: version
         env:
           VERSION: ${{ inputs.version }}
         shell: bash
@@ -69,40 +85,38 @@ jobs:
           set -euo pipefail
           shopt -s extglob
           if [[ "$GITHUB_EVENT_NAME" == pull_request ]]; then
-            echo version="0.0.0-test.${GITHUB_SHA:0:7}"
-            echo archs='["amd64"]'
-            echo oses='["linux"]'
+            echo version="0.0.0-test.${GITHUB_SHA:0:7}" >> "$GITHUB_OUTPUT"
             exit 0
-          fi >> "$GITHUB_OUTPUT"
+          fi
           if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z-]+)?(\+[0-9A-Za-z-]+)?$ ]]; then
             echo "Invalid version: $VERSION" >&2
             exit 1
           fi
-          ( echo version="${VERSION#v}"
-            echo archs='["amd64", "arm64", "arm"]'
+          echo version="${VERSION#v}" >> "$GITHUB_OUTPUT"
+
+      - id: platform
+        shell: bash
+        env:
+          WORKFLOW_CHANGED: ${{ steps.workflow.outputs.any_changed }}
+        run: |
+          if [[ "$GITHUB_EVENT_NAME" == pull_request && "$WORKFLOW_CHANGED" != 'true' ]]; then
+            ( echo archs='["amd64"]'
+              echo oses='["linux"]' ) >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          ( echo archs='["amd64", "arm64"]'
             echo oses='["linux", "windows"]'
           ) >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-        if: github.event_name == 'pull_request'
-      - id: changed
-        if: github.event_name == 'pull_request'
-        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c
-        with:
-          files: |
-            .github/workflows/release.yml
-            justfile
-            Cargo.toml
-
     outputs:
-      archs: ${{ steps.meta.outputs.archs }}
-      oses: ${{ steps.meta.outputs.oses }}
-      version: ${{ steps.meta.outputs.version }}
-      package: ${{ github.event_name == 'workflow_dispatch' || steps.changed.outputs.any_changed == 'true' }}
+      archs: ${{ steps.platform.outputs.archs }}
+      oses: ${{ steps.platform.outputs.oses }}
+      version: ${{ steps.version.outputs.version }}
+      package: ${{ github.event_name == 'workflow_dispatch' || steps.build.outputs.any_changed == 'true' || steps.workflow.outputs.any_changed == 'true' }}
       profile: ${{ inputs.profile || 'release' }}
       publish: ${{ inputs.publish }}
       ref: ${{ inputs.ref || github.sha }}
-      tag: "${{ inputs.tag-prefix || 'release/' }}v${{ steps.meta.outputs.version }}"
+      tag: "${{ inputs.tag-prefix || 'release/' }}v${{ steps.version.outputs.version }}"
       prerelease: ${{ inputs.prerelease }}
       draft: ${{ inputs.draft }}
       latest: ${{ inputs.latest }}
@@ -135,8 +149,6 @@ jobs:
         exclude:
           - os: windows
             arch: arm64
-          - os: windows
-            arch: arm  
 
     # If we're not actually building on a release tag, don't short-circuit on
     # errors. This helps us know whether a failure is platform-specific.
@@ -151,15 +163,19 @@ jobs:
       # TODO: add to dev image
       - name: Install MiniGW
         if: matrix.os == 'windows'
-        run: apt-get update && apt-get install mingw-w64 -y
+        run: apt-get update && apt-get install -y mingw-w64
+      - name: Install cross compilation toolchain
+        if: matrix.arch == 'arm64'
+        run: apt-get update && apt-get install -y binutils-aarch64-linux-gnu
+
       - name: Configure git
         run: git config --global --add safe.directory "$PWD" # actions/runner#2033
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           ref: ${{ needs.meta.outputs.ref }}
       - uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0
         with:
-          key: ${{ matrix.arch }}
+          key: ${{ matrix.os }}-${{ matrix.arch }}
       - run: just fetch
       - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} os=${{ matrix.os }} rustup
       - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} os=${{ matrix.os }} profile=${{ needs.meta.outputs.profile }} build
@@ -188,7 +204,7 @@ jobs:
           git config --global user.name "$GITHUB_USERNAME"
           git config --global user.email "$GITHUB_USERNAME"@users.noreply.github.com
       # Tag the release.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
         with:
           token: ${{ secrets.LINKERD2_PROXY_GITHUB_TOKEN || github.token }}
           ref: ${{ needs.meta.outputs.ref }}
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index 735aad1c9..184c03898 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -16,5 +16,5 @@ jobs:
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
       - uses: linkerd/dev/actions/setup-tools@v47
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: just sh-lint
diff --git a/.github/workflows/toolchain.yml b/.github/workflows/toolchain.yml
index 819652485..946a08564 100644
--- a/.github/workflows/toolchain.yml
+++ b/.github/workflows/toolchain.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     container: ghcr.io/linkerd/dev:v47-rust
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - run: |
           VERSION_REGEX='channel = "([0-9]+\.[0-9]+\.[0-9]+)"'
@@ -38,7 +38,7 @@ jobs:
     runs-on: ${{ vars.LINKERD2_PROXY_RUNNER || 'ubuntu-24.04' }}
     steps:
       - uses: linkerd/dev/actions/setup-tools@v47
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
       - shell: bash
         run: |
           VERSION_REGEX='channel = "([0-9]+\.[0-9]+\.[0-9]+)"'
diff --git a/Cargo.lock b/Cargo.lock
index 90ad441dd..4459aaa93 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -62,9 +62,9 @@ checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
 name = "anyhow"
-version = "1.0.98"
+version = "1.0.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e16d2d3311acee920a9eb8d33b8cbc1787ce4a264e85f964c2404b969bdcd487"
+checksum = "b0674a1ddeecb70197781e945de4b3b8ffb61fa939a5597bcf48503737663100"
 
 [[package]]
 name = "arbitrary"
@@ -87,7 +87,7 @@ dependencies = [
  "nom",
  "num-traits",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "time",
 ]
 
@@ -199,11 +199,10 @@ dependencies = [
 
 [[package]]
 name = "axum"
-version = "0.7.9"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edca88bc138befd0323b20752846e6587272d3b03b0343c8ea28a6f819e6e71f"
+checksum = "021e862c184ae977658b36c4500f7feac3221ca5da43e3f25bd04ab6c79a29b5"
 dependencies = [
- "async-trait",
  "axum-core",
  "bytes",
  "futures-util",
@@ -219,20 +218,19 @@ dependencies = [
  "rustversion",
  "serde",
  "sync_wrapper",
- "tower 0.5.2",
+ "tower",
  "tower-layer",
  "tower-service",
 ]
 
 [[package]]
 name = "axum-core"
-version = "0.4.5"
+version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09f2bd6146b97ae3359fa0cc6d6b376d9539582c7b4220f041a33ec24c226199"
+checksum = "68464cd0412f486726fb3373129ef5d2993f90c34bc2bc1c1e9943b2f4fc7ca6"
 dependencies = [
- "async-trait",
  "bytes",
- "futures-util",
+ "futures-core",
  "http",
  "http-body",
  "http-body-util",
@@ -379,9 +377,9 @@ checksum = "d71b6127be86fdcfddb610f7182ac57211d4b18a3e9c82eb2d17662f2227ad6a"
 
 [[package]]
 name = "cc"
-version = "1.2.30"
+version = "1.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "deec109607ca693028562ed836a5f1c4b8bd77755c4e132fc5ce11b0b6211ae7"
+checksum = "2352e5597e9c544d5e6d9c95190d5d27738ade584fa8db0a16e130e5c2b5296e"
 dependencies = [
  "jobserver",
  "libc",
@@ -531,9 +529,9 @@ dependencies = [
 
 [[package]]
 name = "deranged"
-version = "0.4.1"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28cfac68e08048ae1883171632c2aef3ebc555621ae56fbccce1cbf22dd7f058"
+checksum = "9c9e6a11ca8224451684bc0d7d5a7adbf8f2fd6887261a1cfc3c0432f9d4068e"
 dependencies = [
  "powerfmt",
 ]
@@ -895,21 +893,21 @@ checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
 
 [[package]]
 name = "glob"
-version = "0.3.2"
+version = "0.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a8d1add55171497b4705a648c6b583acafb01d58050a51727785f0b2c8e0a2b2"
+checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "governor"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3cbe789d04bf14543f03c4b60cd494148aa79438c8440ae7d81a7778147745c3"
+checksum = "444405bbb1a762387aa22dd569429533b54a1d8759d35d3b64cb39b0293eaa19"
 dependencies = [
  "cfg-if",
  "futures-sink",
  "futures-timer",
  "futures-util",
- "hashbrown 0.15.2",
+ "hashbrown",
  "nonzero_ext",
  "parking_lot",
  "portable-atomic",
@@ -939,19 +937,13 @@ dependencies = [
  "futures-core",
  "futures-sink",
  "http",
- "indexmap 2.10.0",
+ "indexmap",
  "slab",
  "tokio",
  "tokio-util",
  "tracing",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a9ee70c43aaf417c914396645a0fa852624801b24ebb7ae78fe8272889ac888"
-
 [[package]]
 name = "hashbrown"
 version = "0.15.2"
@@ -999,7 +991,7 @@ dependencies = [
  "once_cell",
  "rand 0.9.2",
  "ring",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tinyvec",
  "tokio",
  "tracing",
@@ -1022,7 +1014,7 @@ dependencies = [
  "rand 0.9.2",
  "resolv-conf",
  "smallvec",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tracing",
 ]
@@ -1115,7 +1107,7 @@ dependencies = [
  "pin-project",
  "tokio",
  "tokio-test",
- "tower 0.5.2",
+ "tower",
 ]
 
 [[package]]
@@ -1146,7 +1138,7 @@ dependencies = [
  "hyper",
  "libc",
  "pin-project-lite",
- "socket2",
+ "socket2 0.6.0",
  "tokio",
  "tower-service",
  "tracing",
@@ -1259,16 +1251,6 @@ dependencies = [
  "icu_properties",
 ]
 
-[[package]]
-name = "indexmap"
-version = "1.9.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bd070e393353796e801d209ad339e89596eb4c8d430d18ede6a1cced8fafbd99"
-dependencies = [
- "autocfg",
- "hashbrown 0.12.3",
-]
-
 [[package]]
 name = "indexmap"
 version = "2.10.0"
@@ -1276,7 +1258,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe4cd85333e22411419a0bcae1297d25e58c9443848b11dc6a86fefe8c78a661"
 dependencies = [
  "equivalent",
- "hashbrown 0.15.2",
+ "hashbrown",
+]
+
+[[package]]
+name = "io-uring"
+version = "0.7.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d93587f37623a1a17d94ef2bc9ada592f5465fe7732084ab7beefabe5c77c0c4"
+dependencies = [
+ "bitflags 2.4.2",
+ "cfg-if",
+ "libc",
 ]
 
 [[package]]
@@ -1285,7 +1278,7 @@ version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b58db92f96b720de98181bbbe63c831e87005ab460c1bf306eb2622b4707997f"
 dependencies = [
- "socket2",
+ "socket2 0.5.10",
  "widestring",
  "windows-sys 0.48.0",
  "winreg",
@@ -1409,9 +1402,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.174"
+version = "0.2.175"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1171693293099992e19cddea4e8b849964e9846f4acee11b3948bcc337be8776"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 
 [[package]]
 name = "libfuzzer-sys"
@@ -1430,7 +1423,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "07033963ba89ebaf1584d767badaa2e8fcec21aedea6b8c0346d487d49c28667"
 dependencies = [
  "cfg-if",
- "windows-targets 0.48.5",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -1440,7 +1433,7 @@ dependencies = [
  "http",
  "ipnet",
  "linkerd-dns-name",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]
 
 [[package]]
@@ -1461,11 +1454,11 @@ dependencies = [
  "linkerd-workers",
  "rangemap",
  "regex",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-stream",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1486,9 +1479,9 @@ dependencies = [
  "pprof",
  "serde",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1503,13 +1496,10 @@ dependencies = [
  "http-body",
  "http-body-util",
  "hyper",
- "hyper-util",
  "ipnet",
  "linkerd-addr",
  "linkerd-conditional",
  "linkerd-dns",
- "linkerd-duplex",
- "linkerd-errno",
  "linkerd-error",
  "linkerd-error-respond",
  "linkerd-exp-backoff",
@@ -1546,18 +1536,15 @@ dependencies = [
  "linkerd-tracing",
  "linkerd-transport-header",
  "linkerd-transport-metrics",
- "parking_lot",
  "pin-project",
  "prometheus-client",
- "quickcheck",
- "regex",
  "semver",
- "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
+ "tokio-rustls",
  "tokio-stream",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1574,11 +1561,11 @@ dependencies = [
  "linkerd-proxy-client-policy",
  "linkerd-proxy-server-policy",
  "once_cell",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-test",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tower-test",
  "tracing",
 ]
@@ -1613,11 +1600,11 @@ dependencies = [
  "once_cell",
  "parking_lot",
  "rangemap",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-test",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1649,12 +1636,12 @@ dependencies = [
  "regex",
  "rustls-pemfile",
  "serde_json",
- "socket2",
+ "socket2 0.6.0",
  "tokio",
  "tokio-rustls",
  "tokio-stream",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
  "tracing-subscriber",
 ]
@@ -1698,12 +1685,12 @@ dependencies = [
  "parking_lot",
  "pin-project",
  "prometheus-client",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-rustls",
  "tokio-test",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tower-test",
  "tracing",
 ]
@@ -1724,12 +1711,12 @@ dependencies = [
  "linkerd-proxy-client-policy",
  "parking_lot",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-stream",
  "tokio-test",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
  "tracing-subscriber",
 ]
@@ -1746,7 +1733,6 @@ dependencies = [
  "linkerd-stack",
  "parking_lot",
  "rand 0.9.2",
- "tokio",
  "tokio-test",
  "tower-test",
  "tracing",
@@ -1756,12 +1742,11 @@ dependencies = [
 name = "linkerd-dns"
 version = "0.1.0"
 dependencies = [
- "futures",
  "hickory-resolver",
  "linkerd-dns-name",
  "linkerd-error",
  "prometheus-client",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tracing",
 ]
@@ -1770,7 +1755,7 @@ dependencies = [
 name = "linkerd-dns-name"
 version = "0.1.0"
 dependencies = [
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "untrusted",
 ]
 
@@ -1795,7 +1780,7 @@ name = "linkerd-error"
 version = "0.1.0"
 dependencies = [
  "futures",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]
 
 [[package]]
@@ -1816,7 +1801,7 @@ dependencies = [
  "pin-project",
  "quickcheck",
  "rand 0.9.2",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
 ]
 
@@ -1880,7 +1865,7 @@ dependencies = [
  "linkerd-stack",
  "linkerd-tracing",
  "prometheus-client",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-test",
  "tracing",
@@ -1898,18 +1883,16 @@ dependencies = [
  "http",
  "linkerd-stack",
  "pin-project",
- "tower 0.5.2",
+ "tower",
 ]
 
 [[package]]
 name = "linkerd-http-metrics"
 version = "0.1.0"
 dependencies = [
- "bytes",
  "futures",
  "http",
  "http-body",
- "hyper",
  "linkerd-error",
  "linkerd-http-classify",
  "linkerd-metrics",
@@ -1917,7 +1900,7 @@ dependencies = [
  "parking_lot",
  "pin-project",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1927,7 +1910,7 @@ version = "0.1.0"
 dependencies = [
  "http",
  "linkerd-stack",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1943,10 +1926,9 @@ dependencies = [
  "linkerd-http-box",
  "linkerd-metrics",
  "linkerd-stack",
- "parking_lot",
  "pin-project",
  "prometheus-client",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
 ]
 
@@ -1958,7 +1940,7 @@ dependencies = [
  "http-body",
  "linkerd-stack",
  "pin-project",
- "tower 0.5.2",
+ "tower",
 ]
 
 [[package]]
@@ -1970,7 +1952,6 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
- "hyper",
  "linkerd-error",
  "linkerd-exp-backoff",
  "linkerd-http-box",
@@ -1980,9 +1961,9 @@ dependencies = [
  "linkerd-tracing",
  "parking_lot",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -1992,10 +1973,9 @@ version = "0.1.0"
 dependencies = [
  "http",
  "linkerd2-proxy-api",
- "maplit",
  "rand 0.9.2",
  "regex",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tracing",
  "url",
 ]
@@ -2011,7 +1991,7 @@ dependencies = [
  "linkerd-stack",
  "parking_lot",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tracing",
 ]
@@ -2020,7 +2000,6 @@ dependencies = [
 name = "linkerd-http-upgrade"
 version = "0.1.0"
 dependencies = [
- "bytes",
  "drain",
  "futures",
  "http",
@@ -2034,9 +2013,9 @@ dependencies = [
  "linkerd-io",
  "linkerd-stack",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
  "try-lock",
 ]
@@ -2046,7 +2025,7 @@ name = "linkerd-http-variant"
 version = "0.1.0"
 dependencies = [
  "http",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]
 
 [[package]]
@@ -2057,7 +2036,7 @@ dependencies = [
  "linkerd-error",
  "linkerd-metrics",
  "prometheus-client",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tracing",
  "url",
 ]
@@ -2066,13 +2045,10 @@ dependencies = [
 name = "linkerd-idle-cache"
 version = "0.1.0"
 dependencies = [
- "futures",
- "linkerd-error",
  "linkerd-stack",
- "linkerd-tracing",
  "parking_lot",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2118,13 +2094,11 @@ name = "linkerd-meshtls-boring"
 version = "0.1.0"
 dependencies = [
  "boring",
- "futures",
  "hex",
  "linkerd-dns-name",
  "linkerd-error",
  "linkerd-identity",
  "linkerd-io",
- "linkerd-meshtls",
  "linkerd-meshtls-verifier",
  "linkerd-stack",
  "linkerd-tls",
@@ -2149,7 +2123,7 @@ dependencies = [
  "linkerd-tls-test-util",
  "rustls-pemfile",
  "rustls-webpki",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-rustls",
  "tracing",
@@ -2173,9 +2147,7 @@ dependencies = [
  "bytes",
  "deflate",
  "http",
- "http-body",
  "http-body-util",
- "hyper",
  "kubert-prometheus-process",
  "linkerd-http-box",
  "linkerd-stack",
@@ -2249,7 +2221,7 @@ dependencies = [
  "linkerd-pool",
  "linkerd-stack",
  "parking_lot",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tower-test",
  "tracing",
@@ -2262,7 +2234,6 @@ dependencies = [
  "ahash",
  "futures",
  "futures-util",
- "indexmap 2.10.0",
  "linkerd-error",
  "linkerd-metrics",
  "linkerd-pool",
@@ -2274,7 +2245,7 @@ dependencies = [
  "rand 0.9.2",
  "tokio",
  "tokio-test",
- "tower 0.5.2",
+ "tower",
  "tower-test",
  "tracing",
 ]
@@ -2295,10 +2266,8 @@ dependencies = [
  "linkerd-tls",
  "linkerd-tonic-stream",
  "linkerd2-proxy-api",
- "pin-project",
- "prost 0.13.5",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2314,9 +2283,8 @@ dependencies = [
  "linkerd-proxy-balance-queue",
  "linkerd-proxy-core",
  "linkerd-stack",
- "rand 0.9.2",
  "tokio",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2342,13 +2310,10 @@ dependencies = [
  "linkerd-tracing",
  "parking_lot",
  "pin-project",
- "prometheus-client",
- "thiserror 2.0.12",
  "tokio",
  "tokio-stream",
  "tokio-test",
  "tokio-util",
- "tower-test",
  "tracing",
 ]
 
@@ -2358,20 +2323,16 @@ version = "0.1.0"
 dependencies = [
  "ahash",
  "http",
- "ipnet",
  "linkerd-error",
  "linkerd-exp-backoff",
  "linkerd-http-route",
  "linkerd-opaq-route",
  "linkerd-proxy-api-resolve",
- "linkerd-proxy-core",
  "linkerd-tls-route",
  "linkerd2-proxy-api",
- "maplit",
  "once_cell",
  "prost-types 0.13.5",
- "quickcheck",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tonic",
 ]
 
@@ -2381,7 +2342,7 @@ version = "0.1.0"
 dependencies = [
  "futures",
  "linkerd-error",
- "tower 0.5.2",
+ "tower",
 ]
 
 [[package]]
@@ -2396,7 +2357,7 @@ dependencies = [
  "linkerd-stack",
  "tokio",
  "tokio-stream",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2404,7 +2365,6 @@ dependencies = [
 name = "linkerd-proxy-http"
 version = "0.1.0"
 dependencies = [
- "async-trait",
  "bytes",
  "drain",
  "futures",
@@ -2412,11 +2372,9 @@ dependencies = [
  "http",
  "http-body",
  "http-body-util",
- "httparse",
  "hyper",
  "hyper-balance",
  "hyper-util",
- "linkerd-duplex",
  "linkerd-error",
  "linkerd-http-box",
  "linkerd-http-classify",
@@ -2432,33 +2390,26 @@ dependencies = [
  "linkerd-proxy-balance",
  "linkerd-stack",
  "linkerd-tracing",
- "parking_lot",
  "pin-project",
- "rand 0.9.2",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-test",
- "tower 0.5.2",
+ "tower",
  "tower-test",
  "tracing",
- "try-lock",
 ]
 
 [[package]]
 name = "linkerd-proxy-identity-client"
 version = "0.1.0"
 dependencies = [
- "futures",
  "http-body",
  "linkerd-dns-name",
  "linkerd-error",
  "linkerd-identity",
- "linkerd-metrics",
  "linkerd-stack",
  "linkerd2-proxy-api",
- "parking_lot",
- "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tonic",
  "tracing",
@@ -2472,8 +2423,8 @@ dependencies = [
  "linkerd-error",
  "linkerd-proxy-core",
  "pin-project",
- "thiserror 2.0.12",
- "tower 0.5.2",
+ "thiserror 2.0.14",
+ "tower",
  "tracing",
 ]
 
@@ -2490,7 +2441,7 @@ dependencies = [
  "maplit",
  "prost-types 0.13.5",
  "quickcheck",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
 ]
 
@@ -2503,16 +2454,14 @@ dependencies = [
  "linkerd-exp-backoff",
  "linkerd-identity",
  "linkerd-proxy-http",
- "linkerd-stack",
  "linkerd-tonic-watch",
  "rcgen",
  "simple_asn1",
  "spiffe-proto",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
- "tokio-test",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
  "x509-parser",
 ]
@@ -2540,11 +2489,10 @@ dependencies = [
  "pin-project",
  "prost-types 0.13.5",
  "quickcheck",
- "rand 0.9.2",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2557,10 +2505,8 @@ dependencies = [
  "linkerd-error",
  "linkerd-proxy-balance",
  "linkerd-stack",
- "pin-project",
- "rand 0.9.2",
  "tokio",
- "tower 0.5.2",
+ "tower",
 ]
 
 [[package]]
@@ -2572,8 +2518,8 @@ dependencies = [
  "linkerd-error",
  "linkerd-io",
  "linkerd-stack",
- "socket2",
- "thiserror 2.0.12",
+ "socket2 0.6.0",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-stream",
  "tracing",
@@ -2587,11 +2533,9 @@ dependencies = [
  "linkerd-error",
  "linkerd-stack",
  "linkerd-tracing",
- "pin-project",
  "tokio",
  "tokio-stream",
  "tokio-test",
- "tower 0.5.2",
  "tower-test",
  "tracing",
 ]
@@ -2603,7 +2547,7 @@ dependencies = [
  "futures",
  "linkerd-error",
  "linkerd-stack",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2616,7 +2560,6 @@ dependencies = [
  "linkerd-error",
  "linkerd-stack",
  "parking_lot",
- "thiserror 2.0.12",
  "tracing",
 ]
 
@@ -2624,14 +2567,12 @@ dependencies = [
 name = "linkerd-service-profiles"
 version = "0.1.0"
 dependencies = [
- "bytes",
  "futures",
  "http",
  "http-body",
  "linkerd-addr",
  "linkerd-dns-name",
  "linkerd-error",
- "linkerd-http-box",
  "linkerd-proxy-api-resolve",
  "linkerd-stack",
  "linkerd-tonic-stream",
@@ -2641,11 +2582,11 @@ dependencies = [
  "prost-types 0.13.5",
  "quickcheck",
  "regex",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-stream",
  "tonic",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2666,11 +2607,11 @@ dependencies = [
  "linkerd-tracing",
  "parking_lot",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
  "tokio-test",
  "tokio-util",
- "tower 0.5.2",
+ "tower",
  "tower-test",
  "tracing",
 ]
@@ -2683,7 +2624,7 @@ dependencies = [
  "parking_lot",
  "tokio",
  "tokio-test",
- "tower 0.5.2",
+ "tower",
  "tower-test",
 ]
 
@@ -2691,10 +2632,8 @@ dependencies = [
 name = "linkerd-stack-tracing"
 version = "0.1.0"
 dependencies = [
- "futures",
- "linkerd-error",
  "linkerd-stack",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2702,7 +2641,6 @@ dependencies = [
 name = "linkerd-tls"
 version = "0.1.0"
 dependencies = [
- "async-trait",
  "bytes",
  "futures",
  "linkerd-conditional",
@@ -2713,9 +2651,8 @@ dependencies = [
  "linkerd-stack",
  "linkerd-tracing",
  "pin-project",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tokio",
- "tower 0.5.2",
  "tracing",
  "untrusted",
 ]
@@ -2727,9 +2664,7 @@ dependencies = [
  "linkerd-dns",
  "linkerd-tls",
  "linkerd2-proxy-api",
- "rand 0.9.2",
- "regex",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tracing",
 ]
 
@@ -2747,7 +2682,6 @@ dependencies = [
  "pin-project",
  "tokio",
  "tokio-stream",
- "tokio-test",
  "tonic",
  "tracing",
 ]
@@ -2762,7 +2696,6 @@ dependencies = [
  "linkerd-tracing",
  "tokio",
  "tokio-stream",
- "tokio-test",
  "tonic",
  "tower-test",
  "tracing",
@@ -2781,7 +2714,7 @@ dependencies = [
  "linkerd-stack",
  "rand 0.8.5",
  "thiserror 1.0.69",
- "tower 0.5.2",
+ "tower",
  "tracing",
 ]
 
@@ -2803,9 +2736,7 @@ name = "linkerd-transport-header"
 version = "0.1.0"
 dependencies = [
  "arbitrary",
- "async-trait",
  "bytes",
- "futures",
  "libfuzzer-sys",
  "linkerd-dns-name",
  "linkerd-error",
@@ -2855,9 +2786,9 @@ dependencies = [
 
 [[package]]
 name = "linkerd2-proxy-api"
-version = "0.16.0"
+version = "0.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f53a8c17b8e81a58651c4e83cef64a8a3d7fba4d0ed224f3ca7e5c40265ec135"
+checksum = "bb83fdbbcea49285182d75aacc20ced8ebce60030be1d72d87b00f58f07d267d"
 dependencies = [
  "h2",
  "http",
@@ -2865,7 +2796,7 @@ dependencies = [
  "prost 0.13.5",
  "prost-types 0.13.5",
  "quickcheck",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tonic",
 ]
 
@@ -2933,9 +2864,9 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e7465ac9959cc2b1404e8e2367b43684a6d13790fe23056cc8c6c5a6b7bcb94"
+checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "memchr"
@@ -3122,7 +3053,6 @@ dependencies = [
 name = "opencensus-proto"
 version = "0.1.0"
 dependencies = [
- "bytes",
  "prost 0.13.5",
  "prost-types 0.13.5",
  "tonic",
@@ -3150,7 +3080,7 @@ dependencies = [
  "futures-sink",
  "js-sys",
  "pin-project-lite",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "tracing",
 ]
 
@@ -3184,7 +3114,7 @@ dependencies = [
  "percent-encoding",
  "rand 0.9.2",
  "serde_json",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]
 
 [[package]]
@@ -3239,7 +3169,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4c5cc86750666a3ed20bdaf5ca2a0344f9c67674cae0515bec2da16fbaa47db"
 dependencies = [
  "fixedbitset",
- "indexmap 2.10.0",
+ "indexmap",
 ]
 
 [[package]]
@@ -3326,7 +3256,7 @@ dependencies = [
  "spin",
  "symbolic-demangle",
  "tempfile",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
 ]
 
 [[package]]
@@ -3350,9 +3280,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.95"
+version = "1.0.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
+checksum = "d61789d7719defeb74ea5fe81f2fdfdbd28a803847077cecce2ff14e1472f6f1"
 dependencies = [
  "unicode-ident",
 ]
@@ -3587,9 +3517,9 @@ dependencies = [
 
 [[package]]
 name = "rangemap"
-version = "1.5.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f60fcc7d6849342eff22c4350c8b9a989ee8ceabc4b481253e8946b9fe83d684"
+checksum = "f93e7e49bb0bf967717f7bd674458b3d6b0c5f48ec7e3038166026a69fc22223"
 
 [[package]]
 name = "rcgen"
@@ -3679,9 +3609,9 @@ dependencies = [
 
 [[package]]
 name = "rustc-demangle"
-version = "0.1.25"
+version = "0.1.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "989e6739f80c4ad5b13e0fd7fe89531180375b18520cc8c82080e4dc4035b84f"
+checksum = "56f7d92ca342cea22a06f2121d944b4fd82af56988c270852495420f961d4ace"
 
 [[package]]
 name = "rustc-hash"
@@ -3741,14 +3671,13 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.29"
+version = "0.23.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2491382039b29b9b11ff08b76ff6c97cf287671dbb74f0be44bda389fffe9bd1"
+checksum = "c0ebcbd2f03de0fc1122ad9bb24b127a5a6cd51d72604a3f3c50ac459762b6cc"
 dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
- "ring",
  "rustls-pki-types",
  "rustls-webpki",
  "subtle",
@@ -3787,9 +3716,9 @@ dependencies = [
 
 [[package]]
 name = "rustversion"
-version = "1.0.21"
+version = "1.0.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8a0d197bd2c9dc6e53b84da9556a69ba4cdfab8619eb41a8bd1cc2027a0f6b1d"
+checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
 
 [[package]]
 name = "ryu"
@@ -3837,9 +3766,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.141"
+version = "1.0.142"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "30b9eff21ebe718216c6ec64e1d9ac57087aad11efc64e32002bce4a0d4c03d3"
+checksum = "030fedb782600dcbd6f02d479bf0d817ac3bb40d644745b769d6a96bc3afc5a7"
 dependencies = [
  "itoa",
  "memchr",
@@ -3875,9 +3804,9 @@ checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
 
 [[package]]
 name = "signal-hook-registry"
-version = "1.4.5"
+version = "1.4.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9203b8055f63a2a00e2f593bb0510367fe707d7ff1e5c872de2f537b339e5410"
+checksum = "b2a4719bff48cee6b39d12c020eeb490953ad2443b7055bd0b21fca26bd8c28b"
 dependencies = [
  "libc",
 ]
@@ -3890,15 +3819,15 @@ checksum = "297f631f50729c8c99b84667867963997ec0b50f32b2a7dbcab828ef0541e8bb"
 dependencies = [
  "num-bigint",
  "num-traits",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "time",
 ]
 
 [[package]]
 name = "slab"
-version = "0.4.10"
+version = "0.4.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04dc19736151f35336d325007ac991178d504a119863a2fcb3758cdb5e52c50d"
+checksum = "7a2ae44ef20feb57a68b23d846850f861394c2e02dc425a50098ae8c90267589"
 
 [[package]]
 name = "smallvec"
@@ -3916,13 +3845,21 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233504af464074f9d066d7b5416c5f9b894a5862a6506e306f7b816cdd6f1807"
+dependencies = [
+ "libc",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "spiffe-proto"
 version = "0.1.0"
 dependencies = [
- "bytes",
  "prost 0.13.5",
- "prost-types 0.13.5",
  "tonic",
  "tonic-build",
 ]
@@ -3959,9 +3896,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "symbolic-common"
-version = "12.16.0"
+version = "12.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9c5199e46f23c77c611aa2a383b2f72721dfee4fb2bf85979eea1e0f26ba6e35"
+checksum = "9da12f8fecbbeaa1ee62c1d50dc656407e007c3ee7b2a41afce4b5089eaef15e"
 dependencies = [
  "debugid",
  "memmap2",
@@ -3971,9 +3908,9 @@ dependencies = [
 
 [[package]]
 name = "symbolic-demangle"
-version = "12.16.0"
+version = "12.16.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa3c03956e32254f74e461a330b9522a2689686d80481708fb2014780d8d3959"
+checksum = "6fd35afe0ef9d35d3dcd41c67ddf882fc832a387221338153b7cd685a105495c"
 dependencies = [
  "cpp_demangle",
  "rustc-demangle",
@@ -3982,9 +3919,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.104"
+version = "2.0.105"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
+checksum = "7bc3fcb250e53458e712715cf74285c1f889686520d79294a9ef3bd7aa1fc619"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4048,11 +3985,11 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "567b8a2dae586314f7be2a752ec7474332959c6460e02bde30d702a66d488708"
+checksum = "0b0949c3a6c842cbde3f1686d6eea5a010516deb7085f79db747562d4102f41e"
 dependencies = [
- "thiserror-impl 2.0.12",
+ "thiserror-impl 2.0.14",
 ]
 
 [[package]]
@@ -4068,9 +4005,9 @@ dependencies = [
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.12"
+version = "2.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f7cf42b4507d8ea322120659672cf1b9dbb93f8f2d4ecfd6e51350ff5b17a1d"
+checksum = "cc5b44b4ab9c2fdd0e0512e6bece8388e214c0749f5862b114cc5b7a25daf227"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4164,20 +4101,22 @@ checksum = "1f3ccbac311fea05f86f61904b462b55fb3df8837a366dfc601a0161d0532f20"
 
 [[package]]
 name = "tokio"
-version = "1.45.0"
+version = "1.47.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2513ca694ef9ede0fb23fe71a4ee4107cb102b9dc1930f6d0fd77aae068ae165"
+checksum = "89e49afdadebb872d3145a5638b59eb0691ea23e46ca484037cfab3b76b95038"
 dependencies = [
  "backtrace",
  "bytes",
+ "io-uring",
  "libc",
  "mio",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2",
+ "slab",
+ "socket2 0.6.0",
  "tokio-macros",
- "windows-sys 0.52.0",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4204,9 +4143,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-metrics"
-version = "0.4.2"
+version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7817b32d36c9b94744d7aa3f8fc13526aa0f5112009d7045f3c659413a6e44ac"
+checksum = "7f960dc1df82e5a0cff5a77e986a10ec7bfabf23ff2377922e012af742878e12"
 dependencies = [
  "futures-util",
  "pin-project-lite",
@@ -4251,9 +4190,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.15"
+version = "0.7.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "66a539a9ad6d5d281510d5bd368c973d636c02dbf8a67300bfb6b950696ad7df"
+checksum = "14307c986784f72ef81c89db7d9e28d6ac26d16213b109ea501696195e6e3ce5"
 dependencies = [
  "bytes",
  "futures-core",
@@ -4264,11 +4203,10 @@ dependencies = [
 
 [[package]]
 name = "tonic"
-version = "0.12.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "877c5b330756d856ffcc4553ab34a5684481ade925ecc54bcd1bf02b1d0d4d52"
+checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
 dependencies = [
- "async-stream",
  "async-trait",
  "axum",
  "base64 0.22.1",
@@ -4283,10 +4221,10 @@ dependencies = [
  "percent-encoding",
  "pin-project",
  "prost 0.13.5",
- "socket2",
+ "socket2 0.5.10",
  "tokio",
  "tokio-stream",
- "tower 0.4.13",
+ "tower",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -4294,9 +4232,9 @@ dependencies = [
 
 [[package]]
 name = "tonic-build"
-version = "0.12.3"
+version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9557ce109ea773b399c9b9e5dca39294110b74f1f342cb347a80d1fce8c26a11"
+checksum = "eac6f67be712d12f0b41328db3137e0d0757645d8904b4cb7d51cd9c2279e847"
 dependencies = [
  "prettyplease",
  "proc-macro2",
@@ -4313,26 +4251,6 @@ dependencies = [
  "tonic-build",
 ]
 
-[[package]]
-name = "tower"
-version = "0.4.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8fa9be0de6cf49e536ce1851f987bd21a43b771b09473c3549a6c853db37c1c"
-dependencies = [
- "futures-core",
- "futures-util",
- "indexmap 1.9.3",
- "pin-project",
- "pin-project-lite",
- "rand 0.8.5",
- "slab",
- "tokio",
- "tokio-util",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "tower"
 version = "0.5.2"
@@ -4341,8 +4259,9 @@ checksum = "d039ad9159c98b70ecfd540b2573b97f7f52c3e8d9f8ad57a24b916a536975f9"
 dependencies = [
  "futures-core",
  "futures-util",
- "indexmap 2.10.0",
+ "indexmap",
  "pin-project-lite",
+ "slab",
  "sync_wrapper",
  "tokio",
  "tokio-util",
@@ -4930,7 +4849,7 @@ dependencies = [
  "nom",
  "oid-registry",
  "rusticata-macros",
- "thiserror 2.0.12",
+ "thiserror 2.0.14",
  "time",
 ]
 
@@ -5048,9 +4967,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.2"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4a05eb080e015ba39cc9e23bbe5e7fb04d5fb040350f99f34e338d5fdd294428"
+checksum = "e7aa2bd55086f1ab526693ecbe444205da57e25f4489879da80635a46d90e73b"
 dependencies = [
  "yoke",
  "zerofrom",
diff --git a/Cargo.toml b/Cargo.toml
index b60de5e96..f0e981d0c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -116,8 +116,8 @@ prost-types = { version = "0.13" }
 tokio-rustls = { version = "0.26", default-features = false, features = [
     "logging",
 ] }
-tonic = { version = "0.12", default-features = false }
-tonic-build = { version = "0.12", default-features = false }
+tonic = { version = "0.13", default-features = false }
+tonic-build = { version = "0.13", default-features = false }
 tower = { version = "0.5", default-features = false }
 tower-service = { version = "0.3" }
 tower-test = { version = "0.4" }
@@ -134,4 +134,4 @@ default-features = false
 features = ["tokio", "tracing"]
 
 [workspace.dependencies.linkerd2-proxy-api]
-version = "0.16.0"
+version = "0.17.0"
diff --git a/Dockerfile b/Dockerfile
index fb9b8a9a5..cfc246a61 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -14,11 +14,16 @@ FROM $LINKERD2_IMAGE as linkerd2
 FROM --platform=$BUILDPLATFORM $RUST_IMAGE as fetch
 
 ARG PROXY_FEATURES=""
+ARG TARGETARCH="amd64"
 RUN apt-get update && \
     apt-get install -y time && \
     if [[ "$PROXY_FEATURES" =~ .*meshtls-boring.* ]] ; then \
       apt-get install -y golang ; \
     fi && \
+    case "$TARGETARCH" in \
+        amd64) true ;; \
+        arm64) apt-get install --no-install-recommends -y binutils-aarch64-linux-gnu ;; \
+    esac && \
     rm -rf /var/lib/apt/lists/*
 
 ENV CARGO_NET_RETRY=10
@@ -33,7 +38,6 @@ RUN --mount=type=cache,id=cargo,target=/usr/local/cargo/registry \
 FROM fetch as build
 ENV CARGO_INCREMENTAL=0
 ENV RUSTFLAGS="-D warnings -A deprecated --cfg tokio_unstable"
-ARG TARGETARCH="amd64"
 ARG PROFILE="release"
 ARG LINKERD2_PROXY_VERSION=""
 ARG LINKERD2_PROXY_VENDOR=""
diff --git a/deny.toml b/deny.toml
index 794ae7996..bf8fc90b3 100644
--- a/deny.toml
+++ b/deny.toml
@@ -2,7 +2,6 @@
 targets = [
     { triple = "x86_64-unknown-linux-gnu" },
     { triple = "aarch64-unknown-linux-gnu" },
-    { triple = "armv7-unknown-linux-gnu" },
 ]
 
 [advisories]
@@ -24,11 +23,6 @@ allow = [
 private = { ignore = true }
 confidence-threshold = 0.8
 exceptions = [
-    { allow = [
-        "ISC",
-        "MIT",
-        "OpenSSL",
-    ], name = "ring", version = "*" },
     { allow = [
         "ISC",
         "OpenSSL",
@@ -39,14 +33,6 @@ exceptions = [
     ], name = "aws-lc-fips-sys", version = "*" },
 ]
 
-[[licenses.clarify]]
-name = "ring"
-version = "*"
-expression = "MIT AND ISC AND OpenSSL"
-license-files = [
-    { path = "LICENSE", hash = 0xbd0eed23 },
-]
-
 [bans]
 multiple-versions = "deny"
 # Wildcard dependencies are used for all workspace-local crates.
@@ -56,6 +42,8 @@ deny = [
     { name = "rustls", wrappers = ["tokio-rustls"] },
     # rustls-webpki should be used instead.
     { name = "webpki" },
+    # aws-lc-rs should be used instead.
+    { name = "ring" }
 ]
 skip = [
     # `linkerd-trace-context`, `rustls-pemfile` and `tonic` depend on `base64`
@@ -76,6 +64,8 @@ skip-tree = [
     { name = "pprof" },
     # aws-lc-rs uses a slightly outdated version of bindgen
     { name = "bindgen", version = "0.69.5" },
+    # socket v0.6 is still propagating through the ecosystem
+    { name = "socket2", version = "0.5" },
 ]
 
 [sources]
diff --git a/justfile b/justfile
index c42b65fd7..24015333e 100644
--- a/justfile
+++ b/justfile
@@ -18,6 +18,10 @@ features := ""
 export LINKERD2_PROXY_VERSION := env_var_or_default("LINKERD2_PROXY_VERSION", "0.0.0-dev" + `git rev-parse --short HEAD`)
 export LINKERD2_PROXY_VENDOR := env_var_or_default("LINKERD2_PROXY_VENDOR", `whoami` + "@" + `hostname`)
 
+# TODO: these variables will be included in dev v48
+export AWS_LC_SYS_CFLAGS_aarch64_unknown_linux_gnu := env_var_or_default("AWS_LC_SYS_CFLAGS_aarch64_unknown_linux_gnu", "-fuse-ld=/usr/aarch64-linux-gnu/bin/ld")
+export AWS_LC_SYS_CFLAGS_aarch64_unknown_linux_musl := env_var_or_default("AWS_LC_SYS_CFLAGS_aarch64_unknown_linux_musl", "-fuse-ld=/usr/aarch64-linux-gnu/bin/ld")
+
 # The version name to use for packages.
 package_version := "v" + LINKERD2_PROXY_VERSION
 
@@ -26,7 +30,7 @@ docker-repo := "localhost/linkerd/proxy"
 docker-tag := `git rev-parse --abbrev-ref HEAD | sed 's|/|.|g'` + "." + `git rev-parse --short HEAD`
 docker-image := docker-repo + ":" + docker-tag
 
-# The architecture name to use for packages. Either 'amd64', 'arm64', or 'arm'.
+# The architecture name to use for packages. Either 'amd64' or 'arm64'.
 arch := "amd64"
 # The OS name to use for packages. Either 'linux' or 'windows'.
 os := "linux"
@@ -39,8 +43,6 @@ _target := if os + '-' + arch == "linux-amd64" {
         "x86_64-unknown-linux-" + libc
     } else if os + '-' + arch == "linux-arm64" {
         "aarch64-unknown-linux-" + libc
-    } else if os + '-' + arch == "linux-arm" {
-        "armv7-unknown-linux-" + libc + "eabihf"
     } else if os + '-' + arch == "windows-amd64" {
         "x86_64-pc-windows-" + libc
     } else {
@@ -139,7 +141,7 @@ _strip:
 
 _package_bin := _package_dir / "bin" / "linkerd2-proxy"
 
-# XXX {aarch64,arm}-musl builds do not enable PIE, so we use target-specific
+# XXX aarch64-musl builds do not enable PIE, so we use target-specific
 # files to document those differences.
 _expected_checksec := '.checksec' / arch + '-' + libc + '.json'
 
diff --git a/linkerd/app/admin/src/server.rs b/linkerd/app/admin/src/server.rs
index 272a01932..e4c04bcca 100644
--- a/linkerd/app/admin/src/server.rs
+++ b/linkerd/app/admin/src/server.rs
@@ -13,7 +13,7 @@
 use futures::future::{self, TryFutureExt};
 use http::StatusCode;
 use linkerd_app_core::{
-    metrics::{self as metrics, FmtMetrics},
+    metrics::{self as metrics, legacy::FmtMetrics},
     proxy::http::{Body, BoxBody, ClientHandle, Request, Response},
     trace, Error, Result,
 };
@@ -32,7 +32,7 @@ pub use self::readiness::{Latch, Readiness};
 
 #[derive(Clone)]
 pub struct Admin<M> {
-    metrics: metrics::Serve<M>,
+    metrics: metrics::legacy::Serve<M>,
     tracing: trace::Handle,
     ready: Readiness,
     shutdown_tx: mpsc::UnboundedSender<()>,
@@ -52,7 +52,7 @@ impl<M> Admin<M> {
         tracing: trace::Handle,
     ) -> Self {
         Self {
-            metrics: metrics::Serve::new(metrics),
+            metrics: metrics::legacy::Serve::new(metrics),
             ready,
             shutdown_tx,
             enable_shutdown,
diff --git a/linkerd/app/admin/src/stack.rs b/linkerd/app/admin/src/stack.rs
index 381243f46..3eb65ad6e 100644
--- a/linkerd/app/admin/src/stack.rs
+++ b/linkerd/app/admin/src/stack.rs
@@ -2,7 +2,7 @@ use linkerd_app_core::{
     classify,
     config::ServerConfig,
     drain, errors, identity,
-    metrics::{self, FmtMetrics},
+    metrics::{self, legacy::FmtMetrics},
     proxy::http,
     serve,
     svc::{self, ExtractParam, InsertParam, Param},
diff --git a/linkerd/app/core/Cargo.toml b/linkerd/app/core/Cargo.toml
index 6daa8b20b..37e052442 100644
--- a/linkerd/app/core/Cargo.toml
+++ b/linkerd/app/core/Cargo.toml
@@ -13,31 +13,24 @@ independently of the inbound and outbound proxy logic.
 """
 
 [dependencies]
-bytes = { workspace = true }
 drain = { workspace = true, features = ["retain"] }
 http = { workspace = true }
 http-body = { workspace = true }
-http-body-util = { workspace = true }
 hyper = { workspace = true, features = ["http1", "http2"] }
-hyper-util = { workspace = true }
 futures = { version = "0.3", default-features = false }
 ipnet = "2.11"
 prometheus-client = { workspace = true }
-regex = "1"
-serde_json = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "sync", "parking_lot"] }
+tokio-rustls = { workspace = true }
 tokio-stream = { version = "0.1", features = ["time"] }
 tonic = { workspace = true, default-features = false, features = ["prost"] }
 tracing = { workspace = true }
-parking_lot = "0.12"
 pin-project = "1"
 
 linkerd-addr = { path = "../../addr" }
 linkerd-conditional = { path = "../../conditional" }
 linkerd-dns = { path = "../../dns" }
-linkerd-duplex = { path = "../../duplex" }
-linkerd-errno = { path = "../../errno" }
 linkerd-error = { path = "../../error" }
 linkerd-error-respond = { path = "../../error-respond" }
 linkerd-exp-backoff = { path = "../../exp-backoff" }
@@ -83,5 +76,6 @@ features = ["make", "spawn-ready", "timeout", "util", "limit"]
 semver = "1"
 
 [dev-dependencies]
+bytes = { workspace = true }
+http-body-util = { workspace = true }
 linkerd-mock-http-body = { path = "../../mock/http-body" }
-quickcheck = { version = "1", default-features = false }
diff --git a/linkerd/app/core/src/control.rs b/linkerd/app/core/src/control.rs
index 4fcb1133b..51e589dc0 100644
--- a/linkerd/app/core/src/control.rs
+++ b/linkerd/app/core/src/control.rs
@@ -101,7 +101,7 @@ impl Config {
         identity: identity::NewClient,
     ) -> svc::ArcNewService<
         (),
-        svc::BoxCloneSyncService<http::Request<tonic::body::BoxBody>, http::Response<RspBody>>,
+        svc::BoxCloneSyncService<http::Request<tonic::body::Body>, http::Response<RspBody>>,
     > {
         let addr = self.addr;
         tracing::trace!(%addr, "Building");
diff --git a/linkerd/app/core/src/lib.rs b/linkerd/app/core/src/lib.rs
index 0d08e2bc2..03a107d32 100644
--- a/linkerd/app/core/src/lib.rs
+++ b/linkerd/app/core/src/lib.rs
@@ -25,6 +25,7 @@ pub mod metrics;
 pub mod proxy;
 pub mod serve;
 pub mod svc;
+pub mod tls_info;
 pub mod transport;
 
 pub use self::build_info::{BuildInfo, BUILD_INFO};
diff --git a/linkerd/app/core/src/metrics.rs b/linkerd/app/core/src/metrics.rs
index c6f887f96..1bb7f72c4 100644
--- a/linkerd/app/core/src/metrics.rs
+++ b/linkerd/app/core/src/metrics.rs
@@ -166,7 +166,7 @@ where
 // === impl Metrics ===
 
 impl Metrics {
-    pub fn new(retain_idle: Duration) -> (Self, impl FmtMetrics + Clone + Send + 'static) {
+    pub fn new(retain_idle: Duration) -> (Self, impl legacy::FmtMetrics + Clone + Send + 'static) {
         let (control, control_report) = {
             let m = http_metrics::Requests::<ControlLabels, Class>::default();
             let r = m.clone().into_report(retain_idle).with_prefix("control");
@@ -223,6 +223,7 @@ impl Metrics {
             opentelemetry,
         };
 
+        use legacy::FmtMetrics as _;
         let report = endpoint_report
             .and_report(profile_route_report)
             .and_report(retry_report)
@@ -248,7 +249,7 @@ impl svc::Param<ControlLabels> for control::ControlAddr {
     }
 }
 
-impl FmtLabels for ControlLabels {
+impl legacy::FmtLabels for ControlLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self { addr, server_id } = self;
 
@@ -281,7 +282,7 @@ impl ProfileRouteLabels {
     }
 }
 
-impl FmtLabels for ProfileRouteLabels {
+impl legacy::FmtLabels for ProfileRouteLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self {
             direction,
@@ -314,7 +315,7 @@ impl From<OutboundEndpointLabels> for EndpointLabels {
     }
 }
 
-impl FmtLabels for EndpointLabels {
+impl legacy::FmtLabels for EndpointLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
             Self::Inbound(i) => (Direction::In, i).fmt_labels(f),
@@ -323,7 +324,7 @@ impl FmtLabels for EndpointLabels {
     }
 }
 
-impl FmtLabels for InboundEndpointLabels {
+impl legacy::FmtLabels for InboundEndpointLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self {
             tls,
@@ -343,7 +344,7 @@ impl FmtLabels for InboundEndpointLabels {
     }
 }
 
-impl FmtLabels for ServerLabel {
+impl legacy::FmtLabels for ServerLabel {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self(meta, port) = self;
         write!(
@@ -374,7 +375,7 @@ impl prom::EncodeLabelSetMut for ServerLabel {
     }
 }
 
-impl FmtLabels for ServerAuthzLabels {
+impl legacy::FmtLabels for ServerAuthzLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self { server, authz } = self;
 
@@ -389,7 +390,7 @@ impl FmtLabels for ServerAuthzLabels {
     }
 }
 
-impl FmtLabels for RouteLabels {
+impl legacy::FmtLabels for RouteLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self { server, route } = self;
 
@@ -404,7 +405,7 @@ impl FmtLabels for RouteLabels {
     }
 }
 
-impl FmtLabels for RouteAuthzLabels {
+impl legacy::FmtLabels for RouteAuthzLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self { route, authz } = self;
 
@@ -425,7 +426,7 @@ impl svc::Param<OutboundZoneLocality> for OutboundEndpointLabels {
     }
 }
 
-impl FmtLabels for OutboundEndpointLabels {
+impl legacy::FmtLabels for OutboundEndpointLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self {
             server_id,
@@ -462,20 +463,20 @@ impl fmt::Display for Direction {
     }
 }
 
-impl FmtLabels for Direction {
+impl legacy::FmtLabels for Direction {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "direction=\"{self}\"")
     }
 }
 
-impl FmtLabels for Authority<'_> {
+impl legacy::FmtLabels for Authority<'_> {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self(authority) = self;
         write!(f, "authority=\"{authority}\"")
     }
 }
 
-impl FmtLabels for Class {
+impl legacy::FmtLabels for Class {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let class = |ok: bool| if ok { "success" } else { "failure" };
 
@@ -523,7 +524,7 @@ impl StackLabels {
     }
 }
 
-impl FmtLabels for StackLabels {
+impl legacy::FmtLabels for StackLabels {
     fn fmt_labels(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         let Self {
             direction,
diff --git a/linkerd/app/core/src/tls_info.rs b/linkerd/app/core/src/tls_info.rs
new file mode 100644
index 000000000..5b7da486d
--- /dev/null
+++ b/linkerd/app/core/src/tls_info.rs
@@ -0,0 +1,76 @@
+use linkerd_metrics::prom;
+use prometheus_client::encoding::{EncodeLabelSet, EncodeLabelValue, LabelValueEncoder};
+use std::{
+    fmt::{Error, Write},
+    sync::{Arc, OnceLock},
+};
+use tracing::error;
+
+static TLS_INFO: OnceLock<Arc<TlsInfo>> = OnceLock::new();
+
+#[derive(Clone, Debug, Default, Hash, PartialEq, Eq, EncodeLabelSet)]
+pub struct TlsInfo {
+    tls_suites: MetricValueList,
+    tls_kx_groups: MetricValueList,
+    tls_rand: String,
+    tls_key_provider: String,
+    tls_fips: bool,
+}
+
+#[derive(Clone, Debug, Default, Hash, PartialEq, Eq)]
+struct MetricValueList {
+    values: Vec<&'static str>,
+}
+
+impl FromIterator<&'static str> for MetricValueList {
+    fn from_iter<T: IntoIterator<Item = &'static str>>(iter: T) -> Self {
+        MetricValueList {
+            values: iter.into_iter().collect(),
+        }
+    }
+}
+
+impl EncodeLabelValue for MetricValueList {
+    fn encode(&self, encoder: &mut LabelValueEncoder<'_>) -> Result<(), Error> {
+        for value in &self.values {
+            value.encode(encoder)?;
+            encoder.write_char(',')?;
+        }
+        Ok(())
+    }
+}
+
+pub fn metric() -> prom::Family<TlsInfo, prom::ConstGauge> {
+    let fam = prom::Family::<TlsInfo, prom::ConstGauge>::new_with_constructor(|| {
+        prom::ConstGauge::new(1)
+    });
+
+    let Some(provider) = tokio_rustls::rustls::crypto::CryptoProvider::get_default() else {
+        // If the crypto provider hasn't been initialized, we return the metrics family with an
+        // empty set of metrics.
+        error!("Initializing TLS info metric before crypto provider initialized, this is a bug!");
+        return fam;
+    };
+
+    let tls_info = TLS_INFO.get_or_init(|| {
+        let tls_suites = provider
+            .cipher_suites
+            .iter()
+            .flat_map(|cipher_suite| cipher_suite.suite().as_str())
+            .collect::<MetricValueList>();
+        let tls_kx_groups = provider
+            .kx_groups
+            .iter()
+            .flat_map(|suite| suite.name().as_str())
+            .collect::<MetricValueList>();
+        Arc::new(TlsInfo {
+            tls_suites,
+            tls_kx_groups,
+            tls_rand: format!("{:?}", provider.secure_random),
+            tls_key_provider: format!("{:?}", provider.key_provider),
+            tls_fips: provider.fips(),
+        })
+    });
+    let _ = fam.get_or_create(tls_info);
+    fam
+}
diff --git a/linkerd/app/core/src/transport/labels.rs b/linkerd/app/core/src/transport/labels.rs
index 9ebcd6c06..c7e06e8cd 100644
--- a/linkerd/app/core/src/transport/labels.rs
+++ b/linkerd/app/core/src/transport/labels.rs
@@ -1,7 +1,7 @@
 use crate::metrics::ServerLabel as PolicyServerLabel;
 pub use crate::metrics::{Direction, OutboundEndpointLabels};
 use linkerd_conditional::Conditional;
-use linkerd_metrics::FmtLabels;
+use linkerd_metrics::legacy::FmtLabels;
 use linkerd_tls as tls;
 use std::{fmt, net::SocketAddr};
 
diff --git a/linkerd/app/inbound/src/metrics.rs b/linkerd/app/inbound/src/metrics.rs
index 4c4ad8f33..313d47827 100644
--- a/linkerd/app/inbound/src/metrics.rs
+++ b/linkerd/app/inbound/src/metrics.rs
@@ -50,7 +50,7 @@ impl InboundMetrics {
     }
 }
 
-impl FmtMetrics for InboundMetrics {
+impl legacy::FmtMetrics for InboundMetrics {
     fn fmt_metrics(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         self.http_authz.fmt_metrics(f)?;
         self.http_errors.fmt_metrics(f)?;
diff --git a/linkerd/app/inbound/src/metrics/authz.rs b/linkerd/app/inbound/src/metrics/authz.rs
index 026745877..2039299cc 100644
--- a/linkerd/app/inbound/src/metrics/authz.rs
+++ b/linkerd/app/inbound/src/metrics/authz.rs
@@ -1,8 +1,9 @@
 use crate::policy::{AllowPolicy, HttpRoutePermit, Meta, ServerPermit};
 use linkerd_app_core::{
     metrics::{
-        metrics, Counter, FmtLabels, FmtMetrics, RouteAuthzLabels, RouteLabels, ServerAuthzLabels,
-        ServerLabel, TargetAddr, TlsAccept,
+        legacy::{Counter, FmtLabels, FmtMetrics},
+        metrics, RouteAuthzLabels, RouteLabels, ServerAuthzLabels, ServerLabel, TargetAddr,
+        TlsAccept,
     },
     tls,
     transport::OrigDstAddr,
diff --git a/linkerd/app/inbound/src/metrics/error.rs b/linkerd/app/inbound/src/metrics/error.rs
index b83313117..bd58b3ec8 100644
--- a/linkerd/app/inbound/src/metrics/error.rs
+++ b/linkerd/app/inbound/src/metrics/error.rs
@@ -8,7 +8,7 @@ use crate::{
 };
 use linkerd_app_core::{
     errors::{FailFastError, LoadShedError},
-    metrics::FmtLabels,
+    metrics::legacy::FmtLabels,
     tls,
 };
 use std::fmt;
diff --git a/linkerd/app/inbound/src/metrics/error/http.rs b/linkerd/app/inbound/src/metrics/error/http.rs
index 9cc9d9f08..3d023e2c6 100644
--- a/linkerd/app/inbound/src/metrics/error/http.rs
+++ b/linkerd/app/inbound/src/metrics/error/http.rs
@@ -1,6 +1,9 @@
 use super::ErrorKind;
 use linkerd_app_core::{
-    metrics::{metrics, Counter, FmtMetrics, ServerLabel},
+    metrics::{
+        legacy::{Counter, FmtMetrics},
+        metrics, ServerLabel,
+    },
     svc::{self, stack::NewMonitor},
     transport::{labels::TargetAddr, OrigDstAddr},
     Error,
diff --git a/linkerd/app/inbound/src/metrics/error/tcp.rs b/linkerd/app/inbound/src/metrics/error/tcp.rs
index 0271a2722..8895c5a30 100644
--- a/linkerd/app/inbound/src/metrics/error/tcp.rs
+++ b/linkerd/app/inbound/src/metrics/error/tcp.rs
@@ -1,6 +1,9 @@
 use super::ErrorKind;
 use linkerd_app_core::{
-    metrics::{metrics, Counter, FmtMetrics},
+    metrics::{
+        legacy::{Counter, FmtMetrics},
+        metrics,
+    },
     svc::{self, stack::NewMonitor},
     transport::{labels::TargetAddr, OrigDstAddr},
     Error,
diff --git a/linkerd/app/inbound/src/policy/api.rs b/linkerd/app/inbound/src/policy/api.rs
index 11bc576b6..579939da2 100644
--- a/linkerd/app/inbound/src/policy/api.rs
+++ b/linkerd/app/inbound/src/policy/api.rs
@@ -33,7 +33,7 @@ static INVALID_POLICY: once_cell::sync::OnceCell<ServerPolicy> = once_cell::sync
 
 impl<S> Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error> + Clone,
+    S: tonic::client::GrpcService<tonic::body::Body, Error = Error> + Clone,
     S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
 {
     pub(super) fn new(
@@ -57,7 +57,7 @@ where
 
 impl<S> Service<u16> for Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+    S: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
     S: Clone + Send + Sync + 'static,
     S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
     S::Future: Send + 'static,
diff --git a/linkerd/app/inbound/src/policy/config.rs b/linkerd/app/inbound/src/policy/config.rs
index c9c5bd375..db447e6de 100644
--- a/linkerd/app/inbound/src/policy/config.rs
+++ b/linkerd/app/inbound/src/policy/config.rs
@@ -40,7 +40,7 @@ impl Config {
         limits: ReceiveLimits,
     ) -> impl GetPolicy + Clone + Send + Sync + 'static
     where
-        C: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+        C: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
         C: Clone + Unpin + Send + Sync + 'static,
         C::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error>,
         C::ResponseBody: Send + 'static,
diff --git a/linkerd/app/inbound/src/policy/store.rs b/linkerd/app/inbound/src/policy/store.rs
index 14b565326..ae58b4f89 100644
--- a/linkerd/app/inbound/src/policy/store.rs
+++ b/linkerd/app/inbound/src/policy/store.rs
@@ -74,7 +74,7 @@ impl<S> Store<S> {
         opaque_ports: RangeInclusiveSet<u16>,
     ) -> Self
     where
-        S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+        S: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
         S: Clone + Send + Sync + 'static,
         S::Future: Send,
         S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
@@ -138,7 +138,7 @@ impl<S> Store<S> {
 
 impl<S> GetPolicy for Store<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+    S: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
     S: Clone + Send + Sync + 'static,
     S::Future: Send,
     S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
diff --git a/linkerd/app/inbound/src/policy/tcp/tests.rs b/linkerd/app/inbound/src/policy/tcp/tests.rs
index 4fdb825e9..4846a0796 100644
--- a/linkerd/app/inbound/src/policy/tcp/tests.rs
+++ b/linkerd/app/inbound/src/policy/tcp/tests.rs
@@ -263,7 +263,7 @@ fn orig_dst_addr() -> OrigDstAddr {
     OrigDstAddr(([192, 0, 2, 2], 1000).into())
 }
 
-impl tonic::client::GrpcService<tonic::body::BoxBody> for MockSvc {
+impl tonic::client::GrpcService<tonic::body::Body> for MockSvc {
     type ResponseBody = linkerd_app_core::control::RspBody;
     type Error = Error;
     type Future = futures::future::Pending<Result<http::Response<Self::ResponseBody>, Self::Error>>;
@@ -275,7 +275,7 @@ impl tonic::client::GrpcService<tonic::body::BoxBody> for MockSvc {
         unreachable!()
     }
 
-    fn call(&mut self, _req: http::Request<tonic::body::BoxBody>) -> Self::Future {
+    fn call(&mut self, _req: http::Request<tonic::body::Body>) -> Self::Future {
         unreachable!()
     }
 }
diff --git a/linkerd/app/inbound/src/server.rs b/linkerd/app/inbound/src/server.rs
index b8458fcce..51cbace86 100644
--- a/linkerd/app/inbound/src/server.rs
+++ b/linkerd/app/inbound/src/server.rs
@@ -27,7 +27,7 @@ impl Inbound<()> {
         limits: ReceiveLimits,
     ) -> impl policy::GetPolicy + Clone + Send + Sync + 'static
     where
-        C: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+        C: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
         C: Clone + Unpin + Send + Sync + 'static,
         C::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error>,
         C::ResponseBody: Send + 'static,
diff --git a/linkerd/app/integration/Cargo.toml b/linkerd/app/integration/Cargo.toml
index 349b1008b..7a2dcfe23 100644
--- a/linkerd/app/integration/Cargo.toml
+++ b/linkerd/app/integration/Cargo.toml
@@ -35,11 +35,11 @@ maplit = "1"
 parking_lot = "0.12"
 regex = "1"
 rustls-pemfile = "2.2"
-socket2 = "0.5"
+socket2 = "0.6"
 tokio = { version = "1", features = ["io-util", "net", "rt", "macros"] }
 tokio-rustls = { workspace = true }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tonic = { workspace = true, features = ["transport"], default-features = false }
+tonic = { workspace = true, features = ["transport", "router"], default-features = false }
 tower = { workspace = true, default-features = false }
 tracing = { workspace = true }
 
diff --git a/linkerd/app/integration/src/policy.rs b/linkerd/app/integration/src/policy.rs
index 977fee256..6b2faa6d7 100644
--- a/linkerd/app/integration/src/policy.rs
+++ b/linkerd/app/integration/src/policy.rs
@@ -302,7 +302,7 @@ impl Controller {
     }
 
     pub async fn run(self) -> controller::Listening {
-        let svc = grpc::transport::Server::builder()
+        let routes = grpc::service::Routes::default()
             .add_service(
                 inbound_server_policies_server::InboundServerPoliciesServer::new(Server(Arc::new(
                     self.inbound,
@@ -310,9 +310,9 @@ impl Controller {
             )
             .add_service(outbound_policies_server::OutboundPoliciesServer::new(
                 Server(Arc::new(self.outbound)),
-            ))
-            .into_service();
-        controller::run(RoutesSvc(svc), "support policy controller", None).await
+            ));
+
+        controller::run(RoutesSvc(routes), "support policy controller", None).await
     }
 }
 
@@ -525,7 +525,9 @@ impl Service<Request<hyper::body::Incoming>> for RoutesSvc {
 
     fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
         let Self(routes) = self;
-        routes.poll_ready(cx)
+        <grpc::service::Routes as Service<Request<UnsyncBoxBody<Bytes, grpc::Status>>>>::poll_ready(
+            routes, cx,
+        )
     }
 
     fn call(&mut self, req: Request<hyper::body::Incoming>) -> Self::Future {
diff --git a/linkerd/app/integration/src/tests/telemetry/tcp_errors.rs b/linkerd/app/integration/src/tests/telemetry/tcp_errors.rs
index 1e5c675be..e8e13d6b7 100644
--- a/linkerd/app/integration/src/tests/telemetry/tcp_errors.rs
+++ b/linkerd/app/integration/src/tests/telemetry/tcp_errors.rs
@@ -124,26 +124,6 @@ async fn inbound_timeout() {
         .await;
 }
 
-/// Tests that the detect metric is labeled and incremented on I/O error.
-#[tokio::test]
-async fn inbound_io_err() {
-    let _trace = trace_init();
-
-    let (proxy, metrics) = Test::default().run().await;
-    let client = crate::tcp::client(proxy.inbound);
-
-    let tcp_client = client.connect().await;
-
-    tcp_client.write(TcpFixture::HELLO_MSG).await;
-    drop(tcp_client);
-
-    metric(&proxy)
-        .label("error", "i/o")
-        .value(1u64)
-        .assert_in(&metrics)
-        .await;
-}
-
 /// Tests that the detect metric is not incremented when TLS is successfully
 /// detected.
 #[tokio::test]
@@ -189,44 +169,6 @@ async fn inbound_success() {
     metric.assert_in(&metrics).await;
 }
 
-/// Tests both of the above cases together.
-#[tokio::test]
-async fn inbound_multi() {
-    let _trace = trace_init();
-
-    let (proxy, metrics) = Test::default().run().await;
-    let client = crate::tcp::client(proxy.inbound);
-
-    let metric = metric(&proxy);
-    let timeout_metric = metric.clone().label("error", "tls detection timeout");
-    let io_metric = metric.label("error", "i/o");
-
-    let tcp_client = client.connect().await;
-
-    tokio::time::sleep(TIMEOUT + Duration::from_millis(15)) // just in case
-        .await;
-
-    timeout_metric.clone().value(1u64).assert_in(&metrics).await;
-    drop(tcp_client);
-
-    let tcp_client = client.connect().await;
-
-    tcp_client.write(TcpFixture::HELLO_MSG).await;
-    drop(tcp_client);
-
-    io_metric.clone().value(1u64).assert_in(&metrics).await;
-    timeout_metric.clone().value(1u64).assert_in(&metrics).await;
-
-    let tcp_client = client.connect().await;
-
-    tokio::time::sleep(TIMEOUT + Duration::from_millis(15)) // just in case
-        .await;
-
-    io_metric.clone().value(1u64).assert_in(&metrics).await;
-    timeout_metric.clone().value(2u64).assert_in(&metrics).await;
-    drop(tcp_client);
-}
-
 /// Tests that TLS detect failure metrics are collected for the direct stack.
 #[tokio::test]
 async fn inbound_direct_multi() {
diff --git a/linkerd/app/outbound/src/lib.rs b/linkerd/app/outbound/src/lib.rs
index 17405e2bb..1d6adb631 100644
--- a/linkerd/app/outbound/src/lib.rs
+++ b/linkerd/app/outbound/src/lib.rs
@@ -146,7 +146,7 @@ impl Outbound<()> {
         export_hostname_labels: bool,
     ) -> impl policy::GetPolicy
     where
-        C: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+        C: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
         C: Clone + Unpin + Send + Sync + 'static,
         C::ResponseBody: proxy::http::Body<Data = tonic::codegen::Bytes, Error = Error>,
         C::ResponseBody: Send + 'static,
diff --git a/linkerd/app/outbound/src/metrics.rs b/linkerd/app/outbound/src/metrics.rs
index 8f1f7a204..386e46e8b 100644
--- a/linkerd/app/outbound/src/metrics.rs
+++ b/linkerd/app/outbound/src/metrics.rs
@@ -130,7 +130,7 @@ impl OutboundMetrics {
     }
 }
 
-impl FmtMetrics for OutboundMetrics {
+impl legacy::FmtMetrics for OutboundMetrics {
     fn fmt_metrics(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         self.http_errors.fmt_metrics(f)?;
         self.tcp_errors.fmt_metrics(f)?;
@@ -243,7 +243,7 @@ impl EncodeLabelSet for RouteRef {
 
 // === impl ConcreteLabels ===
 
-impl FmtLabels for ConcreteLabels {
+impl legacy::FmtLabels for ConcreteLabels {
     fn fmt_labels(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         let ConcreteLabels(parent, backend) = self;
 
diff --git a/linkerd/app/outbound/src/metrics/error.rs b/linkerd/app/outbound/src/metrics/error.rs
index f6f9586d6..8aacc9862 100644
--- a/linkerd/app/outbound/src/metrics/error.rs
+++ b/linkerd/app/outbound/src/metrics/error.rs
@@ -5,7 +5,7 @@ pub(crate) use self::{http::Http, tcp::Tcp};
 use crate::http::IdentityRequired;
 use linkerd_app_core::{
     errors::{FailFastError, LoadShedError},
-    metrics::FmtLabels,
+    metrics::legacy::FmtLabels,
     proxy::http::ResponseTimeoutError,
 };
 use std::fmt;
diff --git a/linkerd/app/outbound/src/metrics/error/http.rs b/linkerd/app/outbound/src/metrics/error/http.rs
index 5ea1194ec..023c4d14d 100644
--- a/linkerd/app/outbound/src/metrics/error/http.rs
+++ b/linkerd/app/outbound/src/metrics/error/http.rs
@@ -1,6 +1,9 @@
 use super::ErrorKind;
 use linkerd_app_core::{
-    metrics::{metrics, Counter, FmtMetrics},
+    metrics::{
+        legacy::{Counter, FmtMetrics},
+        metrics,
+    },
     svc, Error,
 };
 use parking_lot::RwLock;
diff --git a/linkerd/app/outbound/src/metrics/error/tcp.rs b/linkerd/app/outbound/src/metrics/error/tcp.rs
index 59a22b4e2..aa692785f 100644
--- a/linkerd/app/outbound/src/metrics/error/tcp.rs
+++ b/linkerd/app/outbound/src/metrics/error/tcp.rs
@@ -1,6 +1,9 @@
 use super::ErrorKind;
 use linkerd_app_core::{
-    metrics::{metrics, Counter, FmtMetrics},
+    metrics::{
+        legacy::{Counter, FmtMetrics},
+        metrics,
+    },
     svc,
     transport::{labels::TargetAddr, OrigDstAddr},
     Error,
diff --git a/linkerd/app/outbound/src/policy/api.rs b/linkerd/app/outbound/src/policy/api.rs
index 0e6e5a1c0..06e7d1dc7 100644
--- a/linkerd/app/outbound/src/policy/api.rs
+++ b/linkerd/app/outbound/src/policy/api.rs
@@ -33,7 +33,7 @@ static INVALID_POLICY: once_cell::sync::OnceCell<ClientPolicy> = once_cell::sync
 
 impl<S> Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error> + Clone,
+    S: tonic::client::GrpcService<tonic::body::Body, Error = Error> + Clone,
     S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
 {
     pub(crate) fn new(
@@ -59,7 +59,7 @@ where
 
 impl<S> Service<Addr> for Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody, Error = Error>,
+    S: tonic::client::GrpcService<tonic::body::Body, Error = Error>,
     S: Clone + Send + Sync + 'static,
     S::ResponseBody: http::Body<Data = tonic::codegen::Bytes, Error = Error> + Send + 'static,
     S::Future: Send + 'static,
diff --git a/linkerd/app/src/dst.rs b/linkerd/app/src/dst.rs
index 7b4d6acfb..6f7e473e7 100644
--- a/linkerd/app/src/dst.rs
+++ b/linkerd/app/src/dst.rs
@@ -43,7 +43,7 @@ impl Config {
     ) -> Result<
         Dst<
             impl svc::Service<
-                    http::Request<tonic::body::BoxBody>,
+                    http::Request<tonic::body::Body>,
                     Response = http::Response<control::RspBody>,
                     Error = Error,
                     Future = impl Send,
diff --git a/linkerd/app/src/lib.rs b/linkerd/app/src/lib.rs
index 29d4e5a60..68fcbb0f0 100644
--- a/linkerd/app/src/lib.rs
+++ b/linkerd/app/src/lib.rs
@@ -19,9 +19,10 @@ use linkerd_app_core::{
     config::ServerConfig,
     control::{ControlAddr, Metrics as ControlMetrics},
     dns, drain,
-    metrics::{prom, FmtMetrics},
+    metrics::{legacy::FmtMetrics, prom},
     serve,
     svc::Param,
+    tls_info,
     transport::{addrs::*, listen::Bind},
     Error, ProxyRuntime,
 };
@@ -304,6 +305,7 @@ impl Config {
             error!(%error, "Failed to register process metrics");
         }
         registry.register("proxy_build_info", "Proxy build info", BUILD_INFO.metric());
+        registry.register("rustls_info", "Proxy TLS info", tls_info::metric());
 
         let admin = {
             let identity = identity.receiver().server();
diff --git a/linkerd/app/src/policy.rs b/linkerd/app/src/policy.rs
index 218ebe6b2..941e323d8 100644
--- a/linkerd/app/src/policy.rs
+++ b/linkerd/app/src/policy.rs
@@ -46,7 +46,7 @@ impl Config {
     ) -> Result<
         Policy<
             impl svc::Service<
-                    http::Request<tonic::body::BoxBody>,
+                    http::Request<tonic::body::Body>,
                     Response = http::Response<control::RspBody>,
                     Error = Error,
                     Future = impl Send,
diff --git a/linkerd/app/src/trace_collector/oc_collector.rs b/linkerd/app/src/trace_collector/oc_collector.rs
index 96d92856a..d9afd0a06 100644
--- a/linkerd/app/src/trace_collector/oc_collector.rs
+++ b/linkerd/app/src/trace_collector/oc_collector.rs
@@ -6,7 +6,7 @@ use linkerd_opencensus::{self as opencensus, metrics, proto};
 use std::{collections::HashMap, time::SystemTime};
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
-use tonic::{body::BoxBody, client::GrpcService};
+use tonic::{body::Body as TonicBody, client::GrpcService};
 use tracing::Instrument;
 
 pub(super) fn create_collector<S>(
@@ -18,7 +18,7 @@ pub(super) fn create_collector<S>(
     legacy_metrics: metrics::Registry,
 ) -> EnabledCollector
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::Error: Into<Error>,
     S::Future: Send,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
diff --git a/linkerd/app/src/trace_collector/otel_collector.rs b/linkerd/app/src/trace_collector/otel_collector.rs
index da24f574c..c0e05c74d 100644
--- a/linkerd/app/src/trace_collector/otel_collector.rs
+++ b/linkerd/app/src/trace_collector/otel_collector.rs
@@ -15,7 +15,7 @@ use std::{
 };
 use tokio::sync::mpsc;
 use tokio_stream::wrappers::ReceiverStream;
-use tonic::{body::BoxBody, client::GrpcService};
+use tonic::{body::Body as TonicBody, client::GrpcService};
 use tracing::Instrument;
 
 pub(super) struct OtelCollectorAttributes {
@@ -31,7 +31,7 @@ pub(super) fn create_collector<S>(
     legacy_metrics: metrics::Registry,
 ) -> EnabledCollector
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::Error: Into<Error>,
     S::Future: Send,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
diff --git a/linkerd/distribute/Cargo.toml b/linkerd/distribute/Cargo.toml
index 0d624aab5..bce256f44 100644
--- a/linkerd/distribute/Cargo.toml
+++ b/linkerd/distribute/Cargo.toml
@@ -11,7 +11,6 @@ ahash = "0.8"
 linkerd-stack = { path = "../stack" }
 parking_lot = "0.12"
 rand = { version = "0.9", features = ["small_rng"] }
-tokio = { version = "1", features = ["macros"] }
 tracing = { workspace = true }
 
 [dev-dependencies]
diff --git a/linkerd/dns/Cargo.toml b/linkerd/dns/Cargo.toml
index 1b6422183..7aa9d1136 100644
--- a/linkerd/dns/Cargo.toml
+++ b/linkerd/dns/Cargo.toml
@@ -7,14 +7,15 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-futures = { version = "0.3", default-features = false }
 hickory-resolver = "0.25.2"
 linkerd-dns-name = { path = "./name" }
-linkerd-error = { path = "../error" }
 prometheus-client = { workspace = true }
 thiserror = "2"
 tokio = { version = "1", features = ["rt", "sync", "time"] }
 tracing = { workspace = true }
 
+[dev-dependencies]
+linkerd-error = { path = "../error" }
+
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(fuzzing)'] }
diff --git a/linkerd/http/classify/Cargo.toml b/linkerd/http/classify/Cargo.toml
index e50028f5e..c7a7911e4 100644
--- a/linkerd/http/classify/Cargo.toml
+++ b/linkerd/http/classify/Cargo.toml
@@ -15,10 +15,10 @@ tokio = { version = "1", default-features = false }
 tracing = { workspace = true }
 
 linkerd-error = { path = "../../error" }
-linkerd-http-box = { path = "../../http/box" }
 linkerd-stack = { path = "../../stack" }
 
 [dev-dependencies]
 tokio-test = "0.4"
 tower-test = { workspace = true }
+linkerd-http-box = { path = "../../http/box" }
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
diff --git a/linkerd/http/metrics/Cargo.toml b/linkerd/http/metrics/Cargo.toml
index 1c0ab01a3..e135bec90 100644
--- a/linkerd/http/metrics/Cargo.toml
+++ b/linkerd/http/metrics/Cargo.toml
@@ -10,11 +10,9 @@ publish = { workspace = true }
 test-util = []
 
 [dependencies]
-bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
-hyper = { workspace = true, features = ["http1", "http2"] }
 parking_lot = "0.12"
 pin-project = "1"
 tokio = { version = "1", features = ["time"] }
diff --git a/linkerd/http/metrics/src/lib.rs b/linkerd/http/metrics/src/lib.rs
index cfadf887a..62d280678 100644
--- a/linkerd/http/metrics/src/lib.rs
+++ b/linkerd/http/metrics/src/lib.rs
@@ -2,7 +2,7 @@
 #![forbid(unsafe_code)]
 
 pub use self::{requests::Requests, retries::Retries};
-use linkerd_metrics::SharedStore;
+use linkerd_metrics::legacy::SharedStore;
 use parking_lot::Mutex;
 use std::{fmt, hash::Hash, time::Duration};
 
diff --git a/linkerd/http/metrics/src/requests.rs b/linkerd/http/metrics/src/requests.rs
index 83b0af2e8..14670bb34 100644
--- a/linkerd/http/metrics/src/requests.rs
+++ b/linkerd/http/metrics/src/requests.rs
@@ -4,7 +4,10 @@ mod service;
 pub use self::service::{NewHttpMetrics, ResponseBody};
 use super::Report;
 use linkerd_http_classify::ClassifyResponse;
-use linkerd_metrics::{latency, Counter, FmtMetrics, Histogram, LastUpdate, NewMetrics};
+use linkerd_metrics::{
+    latency,
+    legacy::{Counter, FmtMetrics, Histogram, LastUpdate, NewMetrics},
+};
 use linkerd_stack::{self as svc, layer};
 use std::{collections::HashMap, fmt::Debug, hash::Hash};
 use tokio::time::{Duration, Instant};
@@ -146,7 +149,7 @@ impl ClassMetrics {
 mod tests {
     #[test]
     fn expiry() {
-        use linkerd_metrics::FmtLabels;
+        use linkerd_metrics::legacy::FmtLabels;
         use std::fmt;
         use tokio::time::{Duration, Instant};
 
diff --git a/linkerd/http/metrics/src/requests/report.rs b/linkerd/http/metrics/src/requests/report.rs
index 96384d49a..08454be32 100644
--- a/linkerd/http/metrics/src/requests/report.rs
+++ b/linkerd/http/metrics/src/requests/report.rs
@@ -1,7 +1,8 @@
 use super::{ClassMetrics, Metrics, StatusMetrics};
 use crate::{Prefixed, Report};
 use linkerd_metrics::{
-    latency, Counter, FmtLabels, FmtMetric, FmtMetrics, Histogram, Metric, Store,
+    latency,
+    legacy::{Counter, FmtLabels, FmtMetric, FmtMetrics, Histogram, Metric, Store},
 };
 use parking_lot::Mutex;
 use std::{fmt, hash::Hash};
diff --git a/linkerd/http/metrics/src/requests/service.rs b/linkerd/http/metrics/src/requests/service.rs
index 6745211b2..5937fd826 100644
--- a/linkerd/http/metrics/src/requests/service.rs
+++ b/linkerd/http/metrics/src/requests/service.rs
@@ -3,7 +3,7 @@ use futures::{ready, TryFuture};
 use http_body::{Body, Frame};
 use linkerd_error::Error;
 use linkerd_http_classify::{ClassifyEos, ClassifyResponse};
-use linkerd_metrics::NewMetrics;
+use linkerd_metrics::legacy::NewMetrics;
 use linkerd_stack::Proxy;
 use parking_lot::Mutex;
 use pin_project::{pin_project, pinned_drop};
diff --git a/linkerd/http/metrics/src/retries.rs b/linkerd/http/metrics/src/retries.rs
index 84974bb81..c8f3b1524 100644
--- a/linkerd/http/metrics/src/retries.rs
+++ b/linkerd/http/metrics/src/retries.rs
@@ -1,5 +1,5 @@
 use super::{Prefixed, Registry, Report};
-use linkerd_metrics::{Counter, FmtLabels, FmtMetric, FmtMetrics, LastUpdate, Metric};
+use linkerd_metrics::legacy::{Counter, FmtLabels, FmtMetric, FmtMetrics, LastUpdate, Metric};
 use parking_lot::Mutex;
 use std::{fmt, hash::Hash, sync::Arc};
 use tokio::time::{Duration, Instant};
diff --git a/linkerd/http/prom/Cargo.toml b/linkerd/http/prom/Cargo.toml
index 2ff2d3a1b..1877de811 100644
--- a/linkerd/http/prom/Cargo.toml
+++ b/linkerd/http/prom/Cargo.toml
@@ -17,7 +17,6 @@ bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
-parking_lot = "0.12"
 pin-project = "1"
 prometheus-client = { workspace = true }
 thiserror = "2"
diff --git a/linkerd/http/retry/Cargo.toml b/linkerd/http/retry/Cargo.toml
index bb3a34260..3ce349caa 100644
--- a/linkerd/http/retry/Cargo.toml
+++ b/linkerd/http/retry/Cargo.toml
@@ -14,7 +14,6 @@ http-body-util = { workspace = true }
 http = { workspace = true }
 parking_lot = "0.12"
 pin-project = "1"
-tokio = { version = "1", features = ["macros", "rt"] }
 tower = { workspace = true, features = ["retry"] }
 tracing = { workspace = true }
 thiserror = "2"
@@ -26,7 +25,6 @@ linkerd-metrics = { path = "../../metrics" }
 linkerd-stack = { path = "../../stack" }
 
 [dev-dependencies]
-hyper = { workspace = true }
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
 linkerd-mock-http-body = { path = "../../mock/http-body" }
 tokio = { version = "1", features = ["macros", "rt"] }
diff --git a/linkerd/http/route/Cargo.toml b/linkerd/http/route/Cargo.toml
index da2aa6d29..b64e436bd 100644
--- a/linkerd/http/route/Cargo.toml
+++ b/linkerd/http/route/Cargo.toml
@@ -21,6 +21,3 @@ url = "2"
 workspace = true
 features = ["http-route", "grpc-route"]
 optional = true
-
-[dev-dependencies]
-maplit = "1"
diff --git a/linkerd/http/upgrade/Cargo.toml b/linkerd/http/upgrade/Cargo.toml
index 35ecaed97..480f0ec3b 100644
--- a/linkerd/http/upgrade/Cargo.toml
+++ b/linkerd/http/upgrade/Cargo.toml
@@ -10,7 +10,6 @@ Facilities for HTTP/1 upgrades.
 """
 
 [dependencies]
-bytes = { workspace = true }
 drain = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
diff --git a/linkerd/idle-cache/Cargo.toml b/linkerd/idle-cache/Cargo.toml
index 60e0180bc..3d33b9395 100644
--- a/linkerd/idle-cache/Cargo.toml
+++ b/linkerd/idle-cache/Cargo.toml
@@ -10,8 +10,6 @@ publish = { workspace = true }
 test-util = []
 
 [dependencies]
-futures = { version = "0.3", default-features = false }
-linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
 parking_lot = "0.12"
 tokio = { version = "1", default-features = false, features = [
@@ -28,4 +26,3 @@ tokio = { version = "1", default-features = false, features = [
     "test-util",
     "time",
 ] }
-linkerd-tracing = { path = "../tracing", features = ["ansi"] }
diff --git a/linkerd/meshtls/Cargo.toml b/linkerd/meshtls/Cargo.toml
index a870e7c51..28e978348 100644
--- a/linkerd/meshtls/Cargo.toml
+++ b/linkerd/meshtls/Cargo.toml
@@ -8,9 +8,7 @@ publish = { workspace = true }
 
 [features]
 rustls = ["linkerd-meshtls-rustls", "__has_any_tls_impls"]
-rustls-aws-lc = ["rustls", "linkerd-meshtls-rustls/aws-lc"]
-rustls-aws-lc-fips = ["rustls-aws-lc", "linkerd-meshtls-rustls/aws-lc-fips"]
-rustls-ring = ["rustls", "linkerd-meshtls-rustls/ring"]
+rustls-aws-lc-fips = ["linkerd-meshtls-rustls/aws-lc-fips"]
 boring = ["linkerd-meshtls-boring", "__has_any_tls_impls"]
 boring-fips = ["boring", "linkerd-meshtls-boring/fips"]
 # Enabled if *any* TLS impl is enabled.
diff --git a/linkerd/meshtls/boring/Cargo.toml b/linkerd/meshtls/boring/Cargo.toml
index 1cf7755ea..c8ac2f93f 100644
--- a/linkerd/meshtls/boring/Cargo.toml
+++ b/linkerd/meshtls/boring/Cargo.toml
@@ -8,7 +8,6 @@ publish = { workspace = true }
 
 [dependencies]
 boring = "4"
-futures = { version = "0.3", default-features = false }
 hex = "0.4"                                             # used for debug logging
 tokio = { version = "1", features = ["macros", "sync"] }
 tokio-boring = "4"
@@ -27,4 +26,3 @@ fips = ["boring/fips"]
 
 [dev-dependencies]
 linkerd-tls-test-util = { path = "../../tls/test-util" }
-linkerd-meshtls = { path = "../../meshtls" }
diff --git a/linkerd/meshtls/rustls/Cargo.toml b/linkerd/meshtls/rustls/Cargo.toml
index 213afacb7..b51b91f1a 100644
--- a/linkerd/meshtls/rustls/Cargo.toml
+++ b/linkerd/meshtls/rustls/Cargo.toml
@@ -7,19 +7,16 @@ edition = "2018"
 publish = { workspace = true }
 
 [features]
-default = ["ring"]
-ring = ["tokio-rustls/ring", "rustls-webpki/ring"]
-aws-lc = ["tokio-rustls/aws-lc-rs", "rustls-webpki/aws-lc-rs"]
-aws-lc-fips = ["aws-lc", "tokio-rustls/fips"]
+aws-lc-fips = ["tokio-rustls/fips"]
 test-util = ["linkerd-tls-test-util"]
 
 [dependencies]
 futures = { version = "0.3", default-features = false }
 rustls-pemfile = "2.2"
-rustls-webpki = { version = "0.103.4", default-features = false, features = ["std"] }
+rustls-webpki = { version = "0.103.4", default-features = false, features = ["std", "aws-lc-rs"] }
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "rt", "sync"] }
-tokio-rustls = { workspace = true }
+tokio-rustls = { workspace = true, features = ["aws-lc-rs"] }
 tracing = { workspace = true }
 
 linkerd-dns-name = { path = "../../dns/name" }
diff --git a/linkerd/meshtls/rustls/src/backend.rs b/linkerd/meshtls/rustls/src/backend.rs
index edfc64d15..bb60c3207 100644
--- a/linkerd/meshtls/rustls/src/backend.rs
+++ b/linkerd/meshtls/rustls/src/backend.rs
@@ -1,16 +1,3 @@
-#[cfg(all(feature = "aws-lc", feature = "ring"))]
-compile_error!(
-    "Multiple rustls backends enabled. Enabled one of the \"ring\" or \"aws-lc\" features"
-);
-#[cfg(not(any(feature = "aws-lc", feature = "ring")))]
-compile_error!("No rustls backend enabled. Enabled one of the \"ring\" or \"aws-lc\" features");
-
-#[cfg(feature = "aws-lc")]
-mod aws_lc;
-#[cfg(feature = "ring")]
-mod ring;
-
-#[cfg(feature = "aws-lc")]
 pub use aws_lc::{default_provider, SUPPORTED_SIG_ALGS, TLS_SUPPORTED_CIPHERSUITES};
-#[cfg(feature = "ring")]
-pub use ring::{default_provider, SUPPORTED_SIG_ALGS, TLS_SUPPORTED_CIPHERSUITES};
+
+mod aws_lc;
diff --git a/linkerd/meshtls/rustls/src/backend/ring.rs b/linkerd/meshtls/rustls/src/backend/ring.rs
deleted file mode 100644
index 37e54792f..000000000
--- a/linkerd/meshtls/rustls/src/backend/ring.rs
+++ /dev/null
@@ -1,55 +0,0 @@
-pub use ring::default_provider;
-use tokio_rustls::rustls::{
-    self,
-    crypto::{ring, WebPkiSupportedAlgorithms},
-};
-
-pub static TLS_SUPPORTED_CIPHERSUITES: &[rustls::SupportedCipherSuite] = &[
-    ring::cipher_suite::TLS13_AES_128_GCM_SHA256,
-    ring::cipher_suite::TLS13_AES_256_GCM_SHA384,
-    ring::cipher_suite::TLS13_CHACHA20_POLY1305_SHA256,
-];
-// A subset of the algorithms supported by rustls+ring, imported from
-// https://github.com/rustls/rustls/blob/v/0.23.21/rustls/src/crypto/ring/mod.rs#L107
-pub static SUPPORTED_SIG_ALGS: &WebPkiSupportedAlgorithms = &WebPkiSupportedAlgorithms {
-    all: &[
-        webpki::ring::ECDSA_P256_SHA256,
-        webpki::ring::ECDSA_P256_SHA384,
-        webpki::ring::ECDSA_P384_SHA256,
-        webpki::ring::ECDSA_P384_SHA384,
-        webpki::ring::ED25519,
-        webpki::ring::RSA_PKCS1_2048_8192_SHA256,
-        webpki::ring::RSA_PKCS1_2048_8192_SHA384,
-        webpki::ring::RSA_PKCS1_2048_8192_SHA512,
-        webpki::ring::RSA_PKCS1_3072_8192_SHA384,
-    ],
-    mapping: &[
-        (
-            rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
-            &[
-                webpki::ring::ECDSA_P384_SHA384,
-                webpki::ring::ECDSA_P256_SHA384,
-            ],
-        ),
-        (
-            rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
-            &[
-                webpki::ring::ECDSA_P256_SHA256,
-                webpki::ring::ECDSA_P384_SHA256,
-            ],
-        ),
-        (rustls::SignatureScheme::ED25519, &[webpki::ring::ED25519]),
-        (
-            rustls::SignatureScheme::RSA_PKCS1_SHA512,
-            &[webpki::ring::RSA_PKCS1_2048_8192_SHA512],
-        ),
-        (
-            rustls::SignatureScheme::RSA_PKCS1_SHA384,
-            &[webpki::ring::RSA_PKCS1_2048_8192_SHA384],
-        ),
-        (
-            rustls::SignatureScheme::RSA_PKCS1_SHA256,
-            &[webpki::ring::RSA_PKCS1_2048_8192_SHA256],
-        ),
-    ],
-};
diff --git a/linkerd/metrics/Cargo.toml b/linkerd/metrics/Cargo.toml
index 897684f7b..eecd0a9eb 100644
--- a/linkerd/metrics/Cargo.toml
+++ b/linkerd/metrics/Cargo.toml
@@ -16,9 +16,7 @@ test_util = []
 bytes = { workspace = true }
 deflate = { version = "1", features = ["gzip"] }
 http = { workspace = true }
-http-body = { workspace = true }
 http-body-util = { workspace = true }
-hyper = { workspace = true, features = ["http1", "http2"] }
 kubert-prometheus-process = { version = "0.2", optional = true }
 parking_lot = "0.12"
 prometheus-client = { workspace = true }
diff --git a/linkerd/metrics/src/counter.rs b/linkerd/metrics/src/counter.rs
index 3dc422672..ba1f4a2fc 100644
--- a/linkerd/metrics/src/counter.rs
+++ b/linkerd/metrics/src/counter.rs
@@ -1,6 +1,6 @@
 use super::{
     fmt::{FmtLabels, FmtMetric},
-    Factor,
+    legacy::Factor,
 };
 use std::fmt::{self, Display};
 use std::sync::atomic::{AtomicU64, Ordering};
diff --git a/linkerd/metrics/src/histogram.rs b/linkerd/metrics/src/histogram.rs
index cfd8220b6..a6743395e 100644
--- a/linkerd/metrics/src/histogram.rs
+++ b/linkerd/metrics/src/histogram.rs
@@ -2,7 +2,7 @@ use std::fmt;
 use std::marker::PhantomData;
 use std::{cmp, iter, slice};
 
-use super::{Counter, Factor, FmtLabels, FmtMetric};
+use super::legacy::{Counter, Factor, FmtLabels, FmtMetric};
 
 /// A series of latency values and counts.
 #[derive(Debug)]
diff --git a/linkerd/metrics/src/lib.rs b/linkerd/metrics/src/lib.rs
index 111ae1ee8..b06cd5bdd 100644
--- a/linkerd/metrics/src/lib.rs
+++ b/linkerd/metrics/src/lib.rs
@@ -16,16 +16,37 @@ mod store;
 #[cfg(feature = "process")]
 pub use kubert_prometheus_process as process;
 
-#[cfg(feature = "stack")]
-pub use self::new_metrics::NewMetrics;
-pub use self::{
-    counter::Counter,
-    fmt::{FmtLabels, FmtMetric, FmtMetrics, Metric},
-    gauge::Gauge,
-    histogram::Histogram,
-    serve::Serve,
-    store::{LastUpdate, SharedStore, Store},
-};
+/// A legacy metrics implementation.
+///
+/// New metrics should use the interfaces in [`prom`] instead.
+pub mod legacy {
+    // TODO(kate): we will move types like `Counter` and `Gauge` into this module.
+    //
+    // this will help us differentiate in dependent systems which components rely on our legacy
+    // metrics implementation.
+    pub use super::{
+        counter::Counter,
+        fmt::{FmtLabels, FmtMetric, FmtMetrics, Metric},
+        gauge::Gauge,
+        histogram::Histogram,
+        serve::Serve,
+        store::{LastUpdate, SharedStore, Store},
+    };
+
+    #[cfg(feature = "stack")]
+    pub use super::new_metrics::NewMetrics;
+
+    pub trait Factor {
+        fn factor(n: u64) -> f64;
+    }
+
+    impl Factor for () {
+        #[inline]
+        fn factor(n: u64) -> f64 {
+            super::to_f64(n)
+        }
+    }
+}
 
 /// Integration with the [`prometheus_client`]` crate.
 ///
@@ -51,7 +72,7 @@ pub mod prom {
 
     pub type Report = Arc<Registry>;
 
-    impl crate::FmtMetrics for Report {
+    impl crate::legacy::FmtMetrics for Report {
         #[inline]
         fn fmt_metrics(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
             encoding::text::encode(f, self)
@@ -64,8 +85,8 @@ macro_rules! metrics {
     { $( $name:ident : $kind:ty { $help:expr } ),+ } => {
         $(
             #[allow(non_upper_case_globals)]
-            const $name: $crate::Metric<'static, &str, $kind> =
-                $crate::Metric {
+            const $name: $crate::legacy::Metric<'static, &str, $kind> =
+                $crate::legacy::Metric {
                     name: stringify!($name),
                     help: $help,
                     _p: ::std::marker::PhantomData,
@@ -74,8 +95,8 @@ macro_rules! metrics {
     }
 }
 
-pub trait Factor {
-    fn factor(n: u64) -> f64;
+pub fn to_f64(n: u64) -> f64 {
+    n.wrapping_rem(MAX_PRECISE_UINT64 + 1) as f64
 }
 
 /// Largest `u64` that can fit without loss of precision in `f64` (2^53).
@@ -84,14 +105,3 @@ pub trait Factor {
 /// mantissa), thus integer values over 2^53 are not guaranteed to be correctly
 /// exposed.
 const MAX_PRECISE_UINT64: u64 = 0x20_0000_0000_0000;
-
-impl Factor for () {
-    #[inline]
-    fn factor(n: u64) -> f64 {
-        to_f64(n)
-    }
-}
-
-pub fn to_f64(n: u64) -> f64 {
-    n.wrapping_rem(MAX_PRECISE_UINT64 + 1) as f64
-}
diff --git a/linkerd/metrics/src/new_metrics.rs b/linkerd/metrics/src/new_metrics.rs
index 8f4f4c6c8..a139a3635 100644
--- a/linkerd/metrics/src/new_metrics.rs
+++ b/linkerd/metrics/src/new_metrics.rs
@@ -1,4 +1,4 @@
-use crate::SharedStore;
+use crate::legacy::SharedStore;
 use linkerd_stack as svc;
 use std::{fmt, hash::Hash, marker::PhantomData, sync::Arc};
 
diff --git a/linkerd/metrics/src/serve.rs b/linkerd/metrics/src/serve.rs
index 6993a89e3..68695a61e 100644
--- a/linkerd/metrics/src/serve.rs
+++ b/linkerd/metrics/src/serve.rs
@@ -4,7 +4,7 @@ use linkerd_http_box::BoxBody;
 use std::io::Write;
 use tracing::trace;
 
-use super::FmtMetrics;
+use super::legacy::FmtMetrics;
 
 /// Serve Prometheues metrics.
 #[derive(Debug, Clone)]
diff --git a/linkerd/metrics/src/store.rs b/linkerd/metrics/src/store.rs
index 53e16d814..9e50bbc0b 100644
--- a/linkerd/metrics/src/store.rs
+++ b/linkerd/metrics/src/store.rs
@@ -1,4 +1,4 @@
-use crate::{FmtLabels, FmtMetric, Metric};
+use crate::legacy::{FmtLabels, FmtMetric, Metric};
 use parking_lot::Mutex;
 use std::{
     borrow::Borrow,
diff --git a/linkerd/opencensus/src/lib.rs b/linkerd/opencensus/src/lib.rs
index 68ac4b645..894e9dd9c 100644
--- a/linkerd/opencensus/src/lib.rs
+++ b/linkerd/opencensus/src/lib.rs
@@ -19,12 +19,12 @@ use opencensus_proto::{
 use std::collections::HashMap;
 use tokio::{sync::mpsc, time};
 use tokio_stream::wrappers::ReceiverStream;
-use tonic::{self as grpc, body::BoxBody, client::GrpcService};
+use tonic::{self as grpc, body::Body as TonicBody, client::GrpcService};
 use tracing::{debug, info, trace};
 
 pub async fn export_spans<T, S>(client: T, node: Node, spans: S, metrics: Registry)
 where
-    T: GrpcService<BoxBody> + Clone,
+    T: GrpcService<TonicBody> + Clone,
     T::Error: Into<Error>,
     T::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <T::ResponseBody as Body>::Error: Into<Error> + Send,
@@ -49,7 +49,7 @@ struct SpanRxClosed;
 
 impl<T, S> SpanExporter<T, S>
 where
-    T: GrpcService<BoxBody>,
+    T: GrpcService<TonicBody>,
     T::Error: Into<Error>,
     T::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <T::ResponseBody as Body>::Error: Into<Error> + Send,
diff --git a/linkerd/opencensus/src/metrics.rs b/linkerd/opencensus/src/metrics.rs
index 4f456adcf..c2af2061d 100644
--- a/linkerd/opencensus/src/metrics.rs
+++ b/linkerd/opencensus/src/metrics.rs
@@ -1,4 +1,7 @@
-use linkerd_metrics::{metrics, Counter, FmtMetrics};
+use linkerd_metrics::{
+    legacy::{Counter, FmtMetrics},
+    metrics,
+};
 use std::fmt;
 use std::sync::Arc;
 
diff --git a/linkerd/opentelemetry/src/lib.rs b/linkerd/opentelemetry/src/lib.rs
index 2c7aadd15..98cb07ab5 100644
--- a/linkerd/opentelemetry/src/lib.rs
+++ b/linkerd/opentelemetry/src/lib.rs
@@ -29,7 +29,7 @@ use opentelemetry_proto::{
 use opentelemetry_sdk::trace::{SpanData, SpanLinks};
 pub use opentelemetry_sdk::{self as sdk};
 use tokio::{sync::mpsc, time};
-use tonic::{self as grpc, body::BoxBody, client::GrpcService};
+use tonic::{self as grpc, body::Body as TonicBody, client::GrpcService};
 use tracing::{debug, info, trace};
 
 pub async fn export_spans<T, S>(
@@ -38,7 +38,7 @@ pub async fn export_spans<T, S>(
     resource: ResourceAttributesWithSchema,
     metrics: Registry,
 ) where
-    T: GrpcService<BoxBody> + Clone,
+    T: GrpcService<TonicBody> + Clone,
     T::Error: Into<Error>,
     T::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <T::ResponseBody as Body>::Error: Into<Error> + Send,
@@ -65,7 +65,7 @@ struct SpanRxClosed;
 
 impl<T, S> SpanExporter<T, S>
 where
-    T: GrpcService<BoxBody> + Clone,
+    T: GrpcService<TonicBody> + Clone,
     T::Error: Into<Error>,
     T::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <T::ResponseBody as Body>::Error: Into<Error> + Send,
diff --git a/linkerd/opentelemetry/src/metrics.rs b/linkerd/opentelemetry/src/metrics.rs
index 5c785de9d..4b54ac1e8 100644
--- a/linkerd/opentelemetry/src/metrics.rs
+++ b/linkerd/opentelemetry/src/metrics.rs
@@ -1,4 +1,7 @@
-use linkerd_metrics::{metrics, Counter, FmtMetrics};
+use linkerd_metrics::{
+    legacy::{Counter, FmtMetrics},
+    metrics,
+};
 use std::fmt;
 use std::sync::Arc;
 
diff --git a/linkerd/pool/p2c/Cargo.toml b/linkerd/pool/p2c/Cargo.toml
index 3c6746ca7..f9fafea01 100644
--- a/linkerd/pool/p2c/Cargo.toml
+++ b/linkerd/pool/p2c/Cargo.toml
@@ -9,10 +9,8 @@ publish = { workspace = true }
 [dependencies]
 ahash = "0.8"
 futures = { version = "0.3", default-features = false }
-indexmap = "2"
 prometheus-client = { workspace = true }
 rand = { version = "0.9", features = ["small_rng"] }
-tokio = { version = "1", features = ["rt", "sync", "time"] }
 tracing = { workspace = true }
 
 linkerd-error = { path = "../../error" }
@@ -30,5 +28,6 @@ futures-util = { version = "0.3", default-features = false }
 linkerd-tracing = { path = "../../tracing" }
 parking_lot = "0.12"
 quickcheck = { version = "1", default-features = false }
+tokio = { version = "1", features = ["rt", "sync", "time"] }
 tokio-test = "0.4"
 tower-test = { workspace = true }
diff --git a/linkerd/proxy/api-resolve/Cargo.toml b/linkerd/proxy/api-resolve/Cargo.toml
index 579d18d57..cbcb5ac8f 100644
--- a/linkerd/proxy/api-resolve/Cargo.toml
+++ b/linkerd/proxy/api-resolve/Cargo.toml
@@ -22,8 +22,6 @@ linkerd-tls = { path = "../../tls" }
 linkerd-identity = { path = "../../identity" }
 http = { workspace = true }
 http-body = { workspace = true }
-pin-project = "1"
-prost = { workspace = true }
 tonic = { workspace = true, default-features = false }
 tower = { workspace = true, default-features = false }
 tracing = { workspace = true }
diff --git a/linkerd/proxy/api-resolve/src/resolve.rs b/linkerd/proxy/api-resolve/src/resolve.rs
index 56c6b6079..3e36da54a 100644
--- a/linkerd/proxy/api-resolve/src/resolve.rs
+++ b/linkerd/proxy/api-resolve/src/resolve.rs
@@ -7,7 +7,7 @@ use linkerd_stack::Param;
 use linkerd_tonic_stream::{LimitReceiveFuture, ReceiveLimits};
 use std::pin::Pin;
 use std::task::{Context, Poll};
-use tonic::{self as grpc, body::BoxBody, client::GrpcService};
+use tonic::{self as grpc, body::Body as TonicBody, client::GrpcService};
 use tower::Service;
 use tracing::{debug, info, trace};
 
@@ -22,7 +22,7 @@ pub struct Resolve<S> {
 
 impl<S> Resolve<S>
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::Error: Into<Error> + Send,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error: Into<Error> + Send,
@@ -46,7 +46,7 @@ type ResolveFuture =
 impl<T, S> Service<T> for Resolve<S>
 where
     T: Param<ConcreteAddr>,
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::Error: Into<Error> + Send,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error: Into<Error> + Send,
diff --git a/linkerd/proxy/balance/Cargo.toml b/linkerd/proxy/balance/Cargo.toml
index 707334953..db23fd91c 100644
--- a/linkerd/proxy/balance/Cargo.toml
+++ b/linkerd/proxy/balance/Cargo.toml
@@ -8,7 +8,6 @@ publish = { workspace = true }
 
 [dependencies]
 futures = { version = "0.3", default-features = false }
-rand = "0.9"
 tokio = { version = "1", features = ["time"] }
 tracing = { workspace = true }
 
diff --git a/linkerd/proxy/balance/queue/Cargo.toml b/linkerd/proxy/balance/queue/Cargo.toml
index 09195832b..c621dc83d 100644
--- a/linkerd/proxy/balance/queue/Cargo.toml
+++ b/linkerd/proxy/balance/queue/Cargo.toml
@@ -10,8 +10,6 @@ publish = { workspace = true }
 futures = { version = "0.3", default-features = false }
 parking_lot = "0.12"
 pin-project = "1"
-prometheus-client = { workspace = true }
-thiserror = "2"
 tokio = { version = "1", features = ["rt", "sync", "time"] }
 tokio-util = "0.7"
 tracing = { workspace = true }
@@ -25,7 +23,6 @@ linkerd-stack = { path = "../../../stack" }
 [dev-dependencies]
 tokio-stream = { version = "0.1", features = ["sync"] }
 tokio-test = "0.4"
-tower-test = { workspace = true }
 
 linkerd-pool-mock = { path = "../../../pool/mock" }
 linkerd-tracing = { path = "../../../tracing" }
diff --git a/linkerd/proxy/client-policy/Cargo.toml b/linkerd/proxy/client-policy/Cargo.toml
index 88d4356dc..8a219b9e2 100644
--- a/linkerd/proxy/client-policy/Cargo.toml
+++ b/linkerd/proxy/client-policy/Cargo.toml
@@ -17,7 +17,6 @@ proto = [
 
 [dependencies]
 ahash = "0.8"
-ipnet = "2"
 http = { workspace = true }
 once_cell = { version = "1" }
 prost-types = { workspace = true, optional = true }
@@ -30,13 +29,8 @@ linkerd-http-route = { path = "../../http/route" }
 linkerd-tls-route = { path = "../../tls/route" }
 linkerd-opaq-route = { path = "../../opaq-route" }
 linkerd-proxy-api-resolve = { path = "../api-resolve" }
-linkerd-proxy-core = { path = "../core" }
 
 [dependencies.linkerd2-proxy-api]
 workspace = true
 optional = true
 features = ["outbound"]
-
-[dev-dependencies]
-maplit = "1"
-quickcheck = { version = "1", default-features = false }
diff --git a/linkerd/proxy/http/Cargo.toml b/linkerd/proxy/http/Cargo.toml
index d1d4f7bac..32c706b31 100644
--- a/linkerd/proxy/http/Cargo.toml
+++ b/linkerd/proxy/http/Cargo.toml
@@ -12,14 +12,11 @@ This should probably be decomposed into smaller, decoupled crates.
 """
 
 [dependencies]
-async-trait = "0.1"
-bytes = { workspace = true }
 drain = { workspace = true }
 futures = { version = "0.3", default-features = false }
 h2 = { workspace = true }
 http = { workspace = true }
 http-body = { workspace = true }
-httparse = "1"
 hyper = { workspace = true, features = [
     "client",
     "http1",
@@ -35,16 +32,12 @@ hyper-util = { workspace = true, default-features = false, features = [
     "tokio",
     "tracing",
 ] }
-parking_lot = "0.12"
 pin-project = "1"
-rand = "0.9"
 thiserror = "2"
 tokio = { version = "1", features = ["rt", "sync", "time"] }
 tower = { workspace = true, default-features = false }
 tracing = { workspace = true }
-try-lock = "0.2"
 
-linkerd-duplex = { path = "../../duplex" }
 linkerd-error = { path = "../../error" }
 linkerd-http-box = { path = "../../http/box" }
 linkerd-http-classify = { path = "../../http/classify" }
@@ -61,8 +54,8 @@ linkerd-proxy-balance = { path = "../balance" }
 linkerd-stack = { path = "../../stack" }
 
 [dev-dependencies]
+bytes = { workspace = true }
 http-body-util = { workspace = true, features = ["channel"] }
-tokio-test = "0.4"
 tower-test = { workspace = true }
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
 
diff --git a/linkerd/proxy/identity-client/Cargo.toml b/linkerd/proxy/identity-client/Cargo.toml
index 51cdae9f1..cef33a504 100644
--- a/linkerd/proxy/identity-client/Cargo.toml
+++ b/linkerd/proxy/identity-client/Cargo.toml
@@ -7,15 +7,11 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-futures = { version = "0.3", default-features = false }
 linkerd2-proxy-api = { workspace = true, features = ["identity"] }
 linkerd-dns-name = { path = "../../dns/name" }
 linkerd-error = { path = "../../error" }
 linkerd-identity = { path = "../../identity" }
-linkerd-metrics = { path = "../../metrics" }
 linkerd-stack = { path = "../../stack" }
-parking_lot = "0.12"
-pin-project = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["time", "sync"] }
 tonic = { workspace = true, default-features = false }
diff --git a/linkerd/proxy/identity-client/src/certify.rs b/linkerd/proxy/identity-client/src/certify.rs
index 61d313fe5..970a9d350 100644
--- a/linkerd/proxy/identity-client/src/certify.rs
+++ b/linkerd/proxy/identity-client/src/certify.rs
@@ -12,7 +12,7 @@ use std::{
 };
 use thiserror::Error;
 use tokio::time;
-use tonic::{body::BoxBody, client::GrpcService};
+use tonic::{body::Body as TonicBody, client::GrpcService};
 use tracing::{debug, error};
 
 /// Configures the Identity service and local identity.
@@ -92,7 +92,7 @@ impl Certify {
     where
         C: Credentials,
         N: NewService<(), Service = S>,
-        S: GrpcService<BoxBody>,
+        S: GrpcService<TonicBody>,
         S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
         <S::ResponseBody as Body>::Error: Into<Error> + Send,
     {
@@ -154,7 +154,7 @@ async fn certify<C, S>(
 ) -> Result<SystemTime>
 where
     C: Credentials,
-    S: GrpcService<BoxBody>,
+    S: GrpcService<TonicBody>,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error: Into<Error> + Send,
 {
diff --git a/linkerd/proxy/spire-client/Cargo.toml b/linkerd/proxy/spire-client/Cargo.toml
index 20fd3448b..a0691728b 100644
--- a/linkerd/proxy/spire-client/Cargo.toml
+++ b/linkerd/proxy/spire-client/Cargo.toml
@@ -14,7 +14,6 @@ linkerd-identity = { path = "../../identity" }
 spiffe-proto = { path = "../../../spiffe-proto" }
 linkerd-tonic-watch = { path = "../../tonic-watch" }
 linkerd-exp-backoff = { path = "../../exp-backoff" }
-linkerd-stack = { path = "../../stack" }
 tokio = { version = "1", features = ["time", "sync"] }
 tonic = { workspace = true }
 tower = { workspace = true }
@@ -25,4 +24,3 @@ thiserror = "2"
 
 [dev-dependencies]
 rcgen = { version = "0.14.3", default-features = false, features = ["crypto", "pem", "aws_lc_rs"] }
-tokio-test = "0.4"
diff --git a/linkerd/proxy/spire-client/src/api.rs b/linkerd/proxy/spire-client/src/api.rs
index 8d5f068b9..bda890d74 100644
--- a/linkerd/proxy/spire-client/src/api.rs
+++ b/linkerd/proxy/spire-client/src/api.rs
@@ -114,7 +114,7 @@ impl TryFrom<api::X509svid> for Svid {
 
 impl<S> Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody> + Clone,
+    S: tonic::client::GrpcService<tonic::body::Body> + Clone,
     S::Error: Into<Error>,
     S::ResponseBody: Default + http::Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as http::Body>::Error: Into<Error> + Send,
@@ -127,7 +127,7 @@ where
 
 impl<S> Service<()> for Api<S>
 where
-    S: tonic::client::GrpcService<tonic::body::BoxBody> + Clone,
+    S: tonic::client::GrpcService<tonic::body::Body> + Clone,
     S: Clone + Send + Sync + 'static,
     S::ResponseBody: Default + http::Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as http::Body>::Error: Into<Error> + Send,
diff --git a/linkerd/proxy/tap/Cargo.toml b/linkerd/proxy/tap/Cargo.toml
index 265eca2d9..f0b9156ca 100644
--- a/linkerd/proxy/tap/Cargo.toml
+++ b/linkerd/proxy/tap/Cargo.toml
@@ -24,7 +24,6 @@ linkerd-stack = { path = "../../stack" }
 linkerd-tls = { path = "../../tls" }
 parking_lot = "0.12"
 prost-types = { workspace = true }
-rand = { version = "0.9" }
 thiserror = "2"
 tokio = { version = "1", features = ["time"] }
 tower = { workspace = true, default-features = false }
diff --git a/linkerd/proxy/tcp/Cargo.toml b/linkerd/proxy/tcp/Cargo.toml
index dbe9f1737..9c3a38bd1 100644
--- a/linkerd/proxy/tcp/Cargo.toml
+++ b/linkerd/proxy/tcp/Cargo.toml
@@ -12,7 +12,5 @@ linkerd-duplex = { path = "../../duplex" }
 linkerd-error = { path = "../../error" }
 linkerd-proxy-balance = { path = "../../proxy/balance" }
 linkerd-stack = { path = "../../stack" }
-rand = "0.9"
 tokio = { version = "1" }
 tower = { workspace = true, default-features = false }
-pin-project = "1"
diff --git a/linkerd/proxy/transport/Cargo.toml b/linkerd/proxy/transport/Cargo.toml
index d6f6b004e..36302191b 100644
--- a/linkerd/proxy/transport/Cargo.toml
+++ b/linkerd/proxy/transport/Cargo.toml
@@ -14,7 +14,7 @@ futures = { version = "0.3", default-features = false }
 linkerd-error = { path = "../../error" }
 linkerd-io = { path = "../../io" }
 linkerd-stack = { path = "../../stack" }
-socket2 = "0.5"
+socket2 = "0.6"
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "net"] }
 tokio-stream = { version = "0.1", features = ["net"] }
diff --git a/linkerd/proxy/transport/src/orig_dst.rs b/linkerd/proxy/transport/src/orig_dst.rs
index a3aa5c300..10e5c910e 100644
--- a/linkerd/proxy/transport/src/orig_dst.rs
+++ b/linkerd/proxy/transport/src/orig_dst.rs
@@ -103,8 +103,8 @@ fn orig_dst(sock: TcpStream, client_addr: ClientAddr) -> io::Result<(OrigDstAddr
         // IPv4-mapped IPv6 addresses are unwrapped by BindTcp::bind() and received here as
         // SocketAddr::V4. We must call getsockopt with IPv4 constants (via
         // orig_dst_addr_v4) even if it originally was an IPv6
-        ClientAddr(SocketAddr::V4(_)) => sock.original_dst()?,
-        ClientAddr(SocketAddr::V6(_)) => sock.original_dst_ipv6()?,
+        ClientAddr(SocketAddr::V4(_)) => sock.original_dst_v4()?,
+        ClientAddr(SocketAddr::V6(_)) => sock.original_dst_v6()?,
     };
 
     let orig_dst = orig_dst.as_socket().ok_or(io::Error::new(
diff --git a/linkerd/reconnect/Cargo.toml b/linkerd/reconnect/Cargo.toml
index 690975081..39f5da8be 100644
--- a/linkerd/reconnect/Cargo.toml
+++ b/linkerd/reconnect/Cargo.toml
@@ -10,9 +10,7 @@ publish = { workspace = true }
 linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
 futures = { version = "0.3", default-features = false }
-tower = { workspace = true, default-features = false }
 tracing = { workspace = true }
-pin-project = "1"
 
 [dev-dependencies]
 linkerd-tracing = { path = "../tracing" }
diff --git a/linkerd/router/Cargo.toml b/linkerd/router/Cargo.toml
index b172d09ac..9c8b1d9e5 100644
--- a/linkerd/router/Cargo.toml
+++ b/linkerd/router/Cargo.toml
@@ -10,7 +10,6 @@ publish = { workspace = true }
 ahash = "0.8"
 futures = { version = "0.3", default-features = false }
 parking_lot = "0.12"
-thiserror = "2"
 tracing = { workspace = true }
 linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
diff --git a/linkerd/service-profiles/Cargo.toml b/linkerd/service-profiles/Cargo.toml
index f2fd526e0..d63bdf35d 100644
--- a/linkerd/service-profiles/Cargo.toml
+++ b/linkerd/service-profiles/Cargo.toml
@@ -10,7 +10,6 @@ Implements client layers for Linkerd ServiceProfiles.
 """
 
 [dependencies]
-bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
@@ -28,7 +27,6 @@ tracing = { workspace = true }
 linkerd-addr = { path = "../addr" }
 linkerd-dns-name = { path = "../dns/name" }
 linkerd-error = { path = "../error" }
-linkerd-http-box = { path = "../http/box" }
 linkerd-proxy-api-resolve = { path = "../proxy/api-resolve" }
 linkerd-stack = { path = "../stack" }
 linkerd-tonic-stream = { path = "../tonic-stream" }
diff --git a/linkerd/service-profiles/src/client.rs b/linkerd/service-profiles/src/client.rs
index 552b7584f..cbc2bd46f 100644
--- a/linkerd/service-profiles/src/client.rs
+++ b/linkerd/service-profiles/src/client.rs
@@ -10,7 +10,7 @@ use std::{
     sync::Arc,
     task::{Context, Poll},
 };
-use tonic::{body::BoxBody, client::GrpcService};
+use tonic::{body::Body as TonicBody, client::GrpcService};
 use tracing::debug;
 
 /// Creates watches on service profiles.
@@ -31,7 +31,7 @@ struct Inner<S> {
 
 impl<R, S> Client<R, S>
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::ResponseBody: Send + Sync,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error:
@@ -64,7 +64,7 @@ where
 impl<T, R, S> Service<T> for Client<R, S>
 where
     T: Param<LookupAddr>,
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error:
         Into<Box<dyn std::error::Error + Send + Sync + 'static>> + Send,
@@ -111,7 +111,7 @@ type InnerFuture =
 
 impl<S> Inner<S>
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error:
         Into<Box<dyn std::error::Error + Send + Sync + 'static>> + Send,
@@ -128,7 +128,7 @@ where
 
 impl<S> Service<LookupAddr> for Inner<S>
 where
-    S: GrpcService<BoxBody> + Clone + Send + 'static,
+    S: GrpcService<TonicBody> + Clone + Send + 'static,
     S::ResponseBody: Body<Data = tonic::codegen::Bytes> + Send + 'static,
     <S::ResponseBody as Body>::Error:
         Into<Box<dyn std::error::Error + Send + Sync + 'static>> + Send,
diff --git a/linkerd/stack/metrics/src/lib.rs b/linkerd/stack/metrics/src/lib.rs
index 138621887..06f462d6d 100644
--- a/linkerd/stack/metrics/src/lib.rs
+++ b/linkerd/stack/metrics/src/lib.rs
@@ -6,7 +6,10 @@ mod service;
 
 pub use self::layer::TrackServiceLayer;
 pub use self::service::TrackService;
-use linkerd_metrics::{metrics, Counter, FmtLabels, FmtMetrics};
+use linkerd_metrics::{
+    legacy::{Counter, FmtLabels, FmtMetrics},
+    metrics,
+};
 use parking_lot::Mutex;
 use std::{collections::HashMap, fmt, hash::Hash, sync::Arc};
 
diff --git a/linkerd/stack/tracing/Cargo.toml b/linkerd/stack/tracing/Cargo.toml
index 5319f570f..ea8c4bb73 100644
--- a/linkerd/stack/tracing/Cargo.toml
+++ b/linkerd/stack/tracing/Cargo.toml
@@ -7,8 +7,6 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-futures = { version = "0.3", default-features = false }
-linkerd-error = { path = "../../error" }
 linkerd-stack = { path = ".." }
 tower = { workspace = true }
 tracing = { workspace = true }
diff --git a/linkerd/tls/Cargo.toml b/linkerd/tls/Cargo.toml
index caa2bc469..1cb9f8b74 100644
--- a/linkerd/tls/Cargo.toml
+++ b/linkerd/tls/Cargo.toml
@@ -7,7 +7,6 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-async-trait = "0.1"
 bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 linkerd-conditional = { path = "../conditional" }
@@ -19,7 +18,6 @@ linkerd-stack = { path = "../stack" }
 pin-project = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "time"] }
-tower = { workspace = true }
 tracing = { workspace = true }
 untrusted = "0.9"
 
diff --git a/linkerd/tls/route/Cargo.toml b/linkerd/tls/route/Cargo.toml
index 290b5b99c..8bb307196 100644
--- a/linkerd/tls/route/Cargo.toml
+++ b/linkerd/tls/route/Cargo.toml
@@ -10,8 +10,6 @@ publish = { workspace = true }
 proto = ["linkerd2-proxy-api"]
 
 [dependencies]
-regex = "1"
-rand = "0.9"
 thiserror = "2"
 tracing = { workspace = true }
 linkerd-tls = { path = "../" }
diff --git a/linkerd/tonic-stream/Cargo.toml b/linkerd/tonic-stream/Cargo.toml
index 5856751b7..9e87c92da 100644
--- a/linkerd/tonic-stream/Cargo.toml
+++ b/linkerd/tonic-stream/Cargo.toml
@@ -15,7 +15,6 @@ tokio = { version = "1", features = ["time"] }
 tracing = { workspace = true }
 
 [dev-dependencies]
-tokio = { version = "1", features = ["macros"] }
-tokio-test = "0.4"
+tokio = { version = "1", features = ["macros", "test-util"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 linkerd-tracing = { path = "../tracing" }
diff --git a/linkerd/tonic-watch/Cargo.toml b/linkerd/tonic-watch/Cargo.toml
index 9ec1f4ec8..16522ea9d 100644
--- a/linkerd/tonic-watch/Cargo.toml
+++ b/linkerd/tonic-watch/Cargo.toml
@@ -21,5 +21,4 @@ tracing = { workspace = true }
 linkerd-tracing = { path = "../tracing" }
 tokio = { version = "1", features = ["macros"] }
 tokio-stream = { version = "0.1", features = ["sync", "time"] }
-tokio-test = "0.4"
 tower-test = { workspace = true }
diff --git a/linkerd/transport-header/Cargo.toml b/linkerd/transport-header/Cargo.toml
index 6aa7137ad..50b4db09d 100644
--- a/linkerd/transport-header/Cargo.toml
+++ b/linkerd/transport-header/Cargo.toml
@@ -7,9 +7,7 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-async-trait = "0.1"
 bytes = { workspace = true }
-futures = { version = "0.3", default-features = false }
 linkerd-dns-name = { path = "../dns/name" }
 linkerd-error = { path = "../error" }
 linkerd-io = { path = "../io" }
diff --git a/linkerd/transport-metrics/src/lib.rs b/linkerd/transport-metrics/src/lib.rs
index d6281449e..223b83f8a 100644
--- a/linkerd/transport-metrics/src/lib.rs
+++ b/linkerd/transport-metrics/src/lib.rs
@@ -14,7 +14,10 @@ pub use self::{
     server::NewServer,
 };
 use linkerd_errno::Errno;
-use linkerd_metrics::{metrics, Counter, FmtLabels, Gauge, LastUpdate, Store};
+use linkerd_metrics::{
+    legacy::{Counter, FmtLabels, Gauge, LastUpdate, Store},
+    metrics,
+};
 use parking_lot::Mutex;
 use std::{collections::HashMap, fmt, hash::Hash, sync::Arc};
 use tokio::time::{Duration, Instant};
@@ -113,7 +116,7 @@ impl Default for ByEos {
 mod tests {
     #[test]
     fn expiry() {
-        use linkerd_metrics::FmtLabels;
+        use linkerd_metrics::legacy::FmtLabels;
         use std::fmt;
         use tokio::time::{Duration, Instant};
 
diff --git a/linkerd/transport-metrics/src/report.rs b/linkerd/transport-metrics/src/report.rs
index dfa0bab6b..ba26175c6 100644
--- a/linkerd/transport-metrics/src/report.rs
+++ b/linkerd/transport-metrics/src/report.rs
@@ -2,7 +2,7 @@ use super::{
     tcp_close_total, tcp_open_connections, tcp_open_total, tcp_read_bytes_total,
     tcp_write_bytes_total, EosMetrics, Inner,
 };
-use linkerd_metrics::{FmtLabels, FmtMetric, FmtMetrics, Metric};
+use linkerd_metrics::legacy::{FmtLabels, FmtMetric, FmtMetrics, Metric};
 use parking_lot::Mutex;
 use std::{fmt, hash::Hash, sync::Arc};
 use tokio::time::{Duration, Instant};
diff --git a/linkerd2-proxy/Cargo.toml b/linkerd2-proxy/Cargo.toml
index 544147ab7..81f570250 100644
--- a/linkerd2-proxy/Cargo.toml
+++ b/linkerd2-proxy/Cargo.toml
@@ -8,12 +8,11 @@ publish = { workspace = true }
 description = "The main proxy executable"
 
 [features]
-default = ["meshtls-rustls-ring"]
+default = ["meshtls-rustls"]
 meshtls-boring = ["linkerd-meshtls/boring"]
 meshtls-boring-fips = ["linkerd-meshtls/boring-fips"]
-meshtls-rustls-aws-lc = ["linkerd-meshtls/rustls-aws-lc"]
+meshtls-rustls = ["linkerd-meshtls/rustls"]
 meshtls-rustls-aws-lc-fips = ["linkerd-meshtls/rustls-aws-lc-fips"]
-meshtls-rustls-ring = ["linkerd-meshtls/rustls-ring"]
 log-streaming = ["linkerd-app/log-streaming"]
 pprof = ["linkerd-app/pprof"]
 # From https://github.com/polarsignals/rust-jemalloc-pprof/blob/bcf1ad7f7ad3ec8e71098f4d5a9ce55905c7a602/README.md#usage
diff --git a/linkerd2-proxy/src/main.rs b/linkerd2-proxy/src/main.rs
index 17fc1f9e3..f0f782451 100644
--- a/linkerd2-proxy/src/main.rs
+++ b/linkerd2-proxy/src/main.rs
@@ -6,12 +6,7 @@
 
 // Emit a compile-time error if no TLS implementations are enabled. When adding
 // new implementations, add their feature flags here!
-#[cfg(not(any(
-    feature = "meshtls-boring",
-    feature = "meshtls-rustls-ring",
-    feature = "meshtls-rustls-aws-lc",
-    feature = "meshtls-rustls-aws-lc-fips"
-)))]
+#[cfg(not(any(feature = "meshtls-boring", feature = "meshtls-rustls",)))]
 compile_error!(
     "at least one of the following TLS implementations must be enabled: 'meshtls-boring', 'meshtls-rustls'"
 );
diff --git a/opencensus-proto/Cargo.toml b/opencensus-proto/Cargo.toml
index 7b6ac6a1e..fd6f58d5f 100644
--- a/opencensus-proto/Cargo.toml
+++ b/opencensus-proto/Cargo.toml
@@ -12,7 +12,6 @@ Vendored from https://github.com/census-instrumentation/opencensus-proto/.
 """
 
 [dependencies]
-bytes = { workspace = true }
 prost = { workspace = true }
 prost-types = { workspace = true }
 
diff --git a/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs b/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
index 9884c60e0..1b0294e70 100644
--- a/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
+++ b/opencensus-proto/src/gen/opencensus.proto.agent.trace.v1.rs
@@ -61,7 +61,7 @@ pub mod trace_service_client {
     }
     impl<T> TraceServiceClient<T>
     where
-        T: tonic::client::GrpcService<tonic::body::BoxBody>,
+        T: tonic::client::GrpcService<tonic::body::Body>,
         T::Error: Into<StdError>,
         T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
         <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
@@ -82,13 +82,13 @@ pub mod trace_service_client {
             F: tonic::service::Interceptor,
             T::ResponseBody: Default,
             T: tonic::codegen::Service<
-                http::Request<tonic::body::BoxBody>,
+                http::Request<tonic::body::Body>,
                 Response = http::Response<
-                    <T as tonic::client::GrpcService<tonic::body::BoxBody>>::ResponseBody,
+                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                 >,
             >,
             <T as tonic::codegen::Service<
-                http::Request<tonic::body::BoxBody>,
+                http::Request<tonic::body::Body>,
             >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             TraceServiceClient::new(InterceptedService::new(inner, interceptor))
diff --git a/spiffe-proto/Cargo.toml b/spiffe-proto/Cargo.toml
index 28ce208ba..5ad847d60 100644
--- a/spiffe-proto/Cargo.toml
+++ b/spiffe-proto/Cargo.toml
@@ -7,9 +7,7 @@ edition = { workspace = true }
 publish = { workspace = true }
 
 [dependencies]
-bytes = { workspace = true }
 prost = { workspace = true }
-prost-types = { workspace = true }
 
 [dependencies.tonic]
 workspace = true
diff --git a/spiffe-proto/src/gen/spiffe.workloadapi.rs b/spiffe-proto/src/gen/spiffe.workloadapi.rs
index 3d07d61c5..5077e8ae3 100644
--- a/spiffe-proto/src/gen/spiffe.workloadapi.rs
+++ b/spiffe-proto/src/gen/spiffe.workloadapi.rs
@@ -59,7 +59,7 @@ pub mod spiffe_workload_api_client {
     }
     impl<T> SpiffeWorkloadApiClient<T>
     where
-        T: tonic::client::GrpcService<tonic::body::BoxBody>,
+        T: tonic::client::GrpcService<tonic::body::Body>,
         T::Error: Into<StdError>,
         T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
         <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
@@ -80,13 +80,13 @@ pub mod spiffe_workload_api_client {
             F: tonic::service::Interceptor,
             T::ResponseBody: Default,
             T: tonic::codegen::Service<
-                http::Request<tonic::body::BoxBody>,
+                http::Request<tonic::body::Body>,
                 Response = http::Response<
-                    <T as tonic::client::GrpcService<tonic::body::BoxBody>>::ResponseBody,
+                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                 >,
             >,
             <T as tonic::codegen::Service<
-                http::Request<tonic::body::BoxBody>,
+                http::Request<tonic::body::Body>,
             >>::Error: Into<StdError> + std::marker::Send + std::marker::Sync,
         {
             SpiffeWorkloadApiClient::new(InterceptedService::new(inner, interceptor))