diff --git a/frameworks/sark-gateway/compose.gateway-h3.yml b/frameworks/sark-gateway/compose.gateway-h3.yml
index ec9355518..cdcda48cf 100644
--- a/frameworks/sark-gateway/compose.gateway-h3.yml
+++ b/frameworks/sark-gateway/compose.gateway-h3.yml
@@ -1,9 +1,10 @@
+# server busy-polls: its cpuset must stay disjoint from proxy's, else 0 RPS.
 services:
   proxy:
     build:
       context: ./proxy
     network_mode: host
-    cpuset: "${GATEWAY_PROXY_CPUS:-0-1}"
+    cpuset: "${GATEWAY_PROXY_CPUS:-0-19,64-83}"
     security_opt:
       - seccomp:unconfined
     volumes:
@@ -16,7 +17,7 @@ services:
       context: ../sark
       dockerfile: Dockerfile
     network_mode: host
-    cpuset: "${GATEWAY_SERVER_CPUS:-2}"
+    cpuset: "${GATEWAY_SERVER_CPUS:-20-31,84-95}"
     security_opt:
       - seccomp:unconfined
     ulimits:
@@ -26,8 +27,7 @@ services:
         hard: 1048576
     environment:
       - SARK_HTTPARENA_BIND=0.0.0.0:8080
-      - SARK_HTTPARENA_CPU_CORE=${GATEWAY_SERVER_CPU_CORE:-2}
-      - SARK_HTTPARENA_CPU_COUNT=${GATEWAY_SERVER_CPU_COUNT:-1}
       - DATABASE_URL=${DATABASE_URL}
       - DATABASE_MAX_CONN=${DATABASE_MAX_CONN:-32}
       - SARK_HTTPARENA_PER_IP_CAP=0
+      - SARK_HTTPARENA_H1_ONLY=1
diff --git a/frameworks/sark-gateway/compose.gateway.yml b/frameworks/sark-gateway/compose.gateway.yml
index ba5cb8b62..cdcda48cf 100644
--- a/frameworks/sark-gateway/compose.gateway.yml
+++ b/frameworks/sark-gateway/compose.gateway.yml
@@ -1,9 +1,10 @@
+# server busy-polls: its cpuset must stay disjoint from proxy's, else 0 RPS.
 services:
   proxy:
     build:
       context: ./proxy
     network_mode: host
-    cpuset: "${GATEWAY_PROXY_CPUS:-0-2}"
+    cpuset: "${GATEWAY_PROXY_CPUS:-0-19,64-83}"
     security_opt:
       - seccomp:unconfined
     volumes:
@@ -16,7 +17,7 @@ services:
       context: ../sark
       dockerfile: Dockerfile
     network_mode: host
-    cpuset: "${GATEWAY_SERVER_CPUS:-0-2}"
+    cpuset: "${GATEWAY_SERVER_CPUS:-20-31,84-95}"
     security_opt:
       - seccomp:unconfined
     ulimits:
@@ -26,8 +27,7 @@ services:
         hard: 1048576
     environment:
       - SARK_HTTPARENA_BIND=0.0.0.0:8080
-      - SARK_HTTPARENA_CPU_CORE=${GATEWAY_SERVER_CPU_CORE:-0}
-      - SARK_HTTPARENA_CPU_COUNT=${GATEWAY_SERVER_CPU_COUNT:-3}
       - DATABASE_URL=${DATABASE_URL}
       - DATABASE_MAX_CONN=${DATABASE_MAX_CONN:-32}
       - SARK_HTTPARENA_PER_IP_CAP=0
+      - SARK_HTTPARENA_H1_ONLY=1
diff --git a/frameworks/sark-production/compose.production-stack.yml b/frameworks/sark-production/compose.production-stack.yml
index d7d80a58d..eafa62adc 100644
--- a/frameworks/sark-production/compose.production-stack.yml
+++ b/frameworks/sark-production/compose.production-stack.yml
@@ -1,8 +1,9 @@
+# server busy-polls: every service needs its own disjoint cpuset, else 0 RPS.
 services:
   edge:
     build: ./proxy-production
     network_mode: host
-    cpuset: "${GATEWAY_PROXY_CPUS:-0-2}"
+    cpuset: "${GATEWAY_EDGE_CPUS:-0-14,64-78}"
     security_opt:
       - seccomp:unconfined
     ulimits:
@@ -20,14 +21,14 @@ services:
   cache:
     image: redis:7-alpine
     network_mode: host
-    cpuset: "${GATEWAY_SERVER_CPUS:-0-2}"
+    cpuset: "${GATEWAY_CACHE_CPUS:-16-19,80-83}"
     security_opt:
       - seccomp:unconfined
 
   authsvc:
     build: ../_shared/authsvc
     network_mode: host
-    cpuset: "${GATEWAY_SERVER_CPUS:-0-2}"
+    cpuset: "${GATEWAY_AUTH_CPUS:-15,79}"
     security_opt:
       - seccomp:unconfined
     environment:
@@ -39,7 +40,7 @@ services:
       context: ../sark
       dockerfile: Dockerfile
     network_mode: host
-    cpuset: "${GATEWAY_SERVER_CPUS:-0-2}"
+    cpuset: "${GATEWAY_SERVER_CPUS:-20-31,84-95}"
     security_opt:
       - seccomp:unconfined
     ulimits:
@@ -49,11 +50,10 @@ services:
         hard: 1048576
     environment:
       - SARK_HTTPARENA_BIND=0.0.0.0:8080
-      - SARK_HTTPARENA_CPU_CORE=${GATEWAY_SERVER_CPU_CORE:-0}
-      - SARK_HTTPARENA_CPU_COUNT=${GATEWAY_SERVER_CPU_COUNT:-3}
       - DATABASE_URL=${DATABASE_URL}
       - DATABASE_MAX_CONN=${DATABASE_MAX_CONN:-128}
       - REDIS_URL=redis://127.0.0.1:6379
       - SARK_HTTPARENA_PER_IP_CAP=0
+      - SARK_HTTPARENA_H1_ONLY=1
     depends_on:
       - cache
diff --git a/frameworks/sark/Cargo.lock b/frameworks/sark/Cargo.lock
index 4f6b3896c..190e4786f 100644
--- a/frameworks/sark/Cargo.lock
+++ b/frameworks/sark/Cargo.lock
@@ -11,6 +11,21 @@ dependencies = [
  "memchr",
 ]
 
+[[package]]
+name = "alloc-no-stdlib"
+version = "2.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cc7bb162ec39d46ab1ca8c77bf72e890535becd1751bb45f64c597edb4c8c6b3"
+
+[[package]]
+name = "alloc-stdlib"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e76a019e91224d279006ff972f1e984179a6e9feb050adba6ce8274aef23195"
+dependencies = [
+ "alloc-no-stdlib",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.103"
@@ -64,9 +79,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.0"
+version = "1.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+checksum = "4342d8937fc7e5dd9b1c60292261c0670c882a2cd1719cfc11b1af41731e32ad"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -75,14 +90,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.41.0"
+version = "0.42.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+checksum = "6d9ceb1da931507a12f4fccea479dccd00da1943e1b4ae72d8e502d707361444"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -91,6 +107,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bit-vec"
 version = "0.9.1"
@@ -115,6 +137,27 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "brotli"
+version = "8.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5cc91aac060a7a1e25823bdccbfb6af1875b88f17c6daac97894eed8207166b3"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+ "brotli-decompressor",
+]
+
+[[package]]
+name = "brotli-decompressor"
+version = "5.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3a32acac15fe1967bc3986b2a6347dffc965602354ea6f450ad07e8bfd253583"
+dependencies = [
+ "alloc-no-stdlib",
+ "alloc-stdlib",
+]
+
 [[package]]
 name = "bytes"
 version = "1.12.0"
@@ -204,6 +247,12 @@ version = "0.5.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -220,6 +269,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "hybrid-array",
+ "rand_core",
 ]
 
 [[package]]
@@ -237,6 +287,16 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
+[[package]]
+name = "der"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71fd89660b2dc699704064e59e9dba0147b903e85319429e131620d022be411b"
+dependencies = [
+ "const-oid",
+ "zeroize",
+]
+
 [[package]]
 name = "der-parser"
 version = "10.0.0"
@@ -281,9 +341,9 @@ dependencies = [
 
 [[package]]
 name = "dope"
-version = "0.5.0"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f2af5f0b2507932706f970ded9a6c4de89431a9f855a7d61a0c7e698857781"
+checksum = "99b1fe82bd8665f9b2d78a47b2c28834c9d3dbd6497575d7ebdad07de6acc35e"
 dependencies = [
  "io-uring",
  "libc",
@@ -293,9 +353,9 @@ dependencies = [
 
 [[package]]
 name = "dope-extra"
-version = "0.5.0"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1ce0d8ae99e97adb8a9b4247d382d0726ee84c01547e2151909dd967d2ca411"
+checksum = "0acda19f64a371f88a39a77b27322719008851221fd670b206544f0fe46be8c5"
 dependencies = [
  "dope",
  "libc",
@@ -304,9 +364,9 @@ dependencies = [
 
 [[package]]
 name = "dope-gen"
-version = "0.5.0"
+version = "0.5.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8352e7b40f75f8af0e895b272048761eb16809c91f387d5d3cdac28c0b05a029"
+checksum = "172c8823fb0399a240959a6707648cb73153b102cfdd3d565b6eb49dc9a777ee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -315,9 +375,9 @@ dependencies = [
 
 [[package]]
 name = "dope-quic"
-version = "0.3.0"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5efd83eb653fea7b22da51f6db6294f3fb80071313067fb5199ba45b32110170"
+checksum = "cab4925ade745050e1c92a1d432e7e6b75ac4a7c1beff935e883b7b2b6aaf374"
 dependencies = [
  "dope",
  "dope-gen",
@@ -330,9 +390,9 @@ dependencies = [
 
 [[package]]
 name = "dope-tls"
-version = "0.6.0"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c9396db331682a3e5ef84809f1b86bf40599ba4326c47d81b2e15ff7d7fc1c7"
+checksum = "0a5af394c381626a55bd36b9c23e3af772966b2937b33ebccf9d4e73ae81a3c3"
 dependencies = [
  "dope",
  "libc",
@@ -441,7 +501,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
@@ -531,11 +591,13 @@ checksum = "6dbf3de79e51f3d586ab4cb9d5c3e2c14aa28ed23d180cf89b4df0454a69cc87"
 
 [[package]]
 name = "hybrid-array"
-version = "0.4.12"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9155a582abd142abc056962c29e3ce5ff2ad5469f4246b537ed42c5deba857da"
+checksum = "818356c5132c1fede50f837ca96afbe78ff42413047f4abb886217845e1b6c8c"
 dependencies = [
+ "ctutils",
  "typenum",
+ "zeroize",
 ]
 
 [[package]]
@@ -550,9 +612,9 @@ dependencies = [
 
 [[package]]
 name = "io-uring"
-version = "0.7.12"
+version = "0.7.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d09b98f7eace8982db770e4408e7470b028ce513ac28fecdc6bf4c30fe92b62"
+checksum = "9080b15e63775b9a2ac7dca720f7050a8b955e092ea0f6020a4a80f69998cdc0"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -584,6 +646,26 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "keccak"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9e24a010dd405bd7ed803e5253182815b41bf2e6a80cc3bfc066658e03a198aa"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+]
+
+[[package]]
+name = "kem"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01737161ba802849cfd486b5bd209d38ba4943494c249a8126005170c7621edd"
+dependencies = [
+ "crypto-common",
+ "rand_core",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -638,6 +720,33 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
+[[package]]
+name = "ml-kem"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
+dependencies = [
+ "hybrid-array",
+ "kem",
+ "module-lattice",
+ "pkcs8",
+ "rand_core",
+ "sha3",
+ "zeroize",
+]
+
+[[package]]
+name = "module-lattice"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c61b87c9683ab7cb1c6871d261ad5479b6b10ceb52c4352aaca3b5d35a8febe"
+dependencies = [
+ "ctutils",
+ "hybrid-array",
+ "num-traits",
+ "zeroize",
+]
+
 [[package]]
 name = "multimap"
 version = "0.10.1"
@@ -759,6 +868,22 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "pkcs8"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "451913da69c775a56034ea8d9003d27ee8948e12443eae7c038ba100a4f21cb7"
+dependencies = [
+ "der",
+ "spki",
+]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
+
 [[package]]
 name = "powerfmt"
 version = "0.2.0"
@@ -872,26 +997,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "getrandom 0.4.3",
- "rand_core 0.10.1",
+ "rand_core",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+checksum = "3e6af7f3e25ded52c41df4e0b1af2d047e45896c2f3281792ed68a1c243daedb"
 dependencies = [
  "ppv-lite86",
- "rand_core 0.9.5",
-]
-
-[[package]]
-name = "rand_core"
-version = "0.9.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76afc826de14238e6e8c374ddcc1fa19e374fd8dd986b0d2af0d02377261d83c"
-dependencies = [
- "getrandom 0.3.4",
+ "rand_core",
 ]
 
 [[package]]
@@ -996,9 +1112,9 @@ checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
 [[package]]
 name = "sark"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9ca0d62dc00179336a99c67ba367e73df0d5e577a56f12110478697d8e9512d"
+checksum = "420cdacd2626e1c5a20424d3c11c6ad0b55636d80bf5a12f5fe61a77114b2b11"
 dependencies = [
  "dope",
  "dope-extra",
@@ -1017,10 +1133,11 @@ dependencies = [
 
 [[package]]
 name = "sark-core"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fbd4939154594f8aa2f44bc0460b8f4038abda3f6ac5a427f83fbe2c2521a93"
+checksum = "3949dc53b561e4c2722cbea5adbf5e694af322577941bf32c0c02b059209757f"
 dependencies = [
+ "brotli",
  "http",
  "httparse",
  "libdeflater",
@@ -1034,9 +1151,9 @@ dependencies = [
 
 [[package]]
 name = "sark-gen"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2ea73efb9483ff8e25d560a00416a584a19bec3d999b7f87c8089e54ff5e07d8"
+checksum = "822c2496faf77aea4efc834d72062ed5d53be86e6b7b12c74a26253e47d312bb"
 dependencies = [
  "dope",
  "o3",
@@ -1047,9 +1164,9 @@ dependencies = [
 
 [[package]]
 name = "sark-grpc"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d3665a1f8ebf14b599ead1ebae3c333e00133ed22630a255f1828e171378b87c"
+checksum = "042ea1eb87158113c9ac8637ec8b0fc5474f1157bb15e08cdbc439bcb1612a10"
 dependencies = [
  "dope",
  "dope-extra",
@@ -1064,18 +1181,18 @@ dependencies = [
 
 [[package]]
 name = "sark-grpc-build"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14991dcd6c9a4f5330d8ef012f3d749cab682512647be1bb4edffa9acfd7bc9a"
+checksum = "076e604ccc96149135cc97f7fec6a9ef6253abcceeb49a38131e2bb61bb37539"
 dependencies = [
  "prost-build",
 ]
 
 [[package]]
 name = "sark-h2"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9daff2eebc0646ec9e82752cdd4c8196f7c16a85c2bf1c360ca4a26b1317cff"
+checksum = "38cd5859b112ad033b65dabb2892fd2e462cd93b6c64621244a8bde8d6e6cb85"
 dependencies = [
  "dope",
  "dope-extra",
@@ -1089,9 +1206,9 @@ dependencies = [
 
 [[package]]
 name = "sark-h3"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "108b80be29c10a88c345594513b9664e173e02f55cd28b482e3860afac7a9f57"
+checksum = "0fd3c3cd0a0edb377f7f22b2c40e904cd3a45404a409024bc15ad074f5f17ad4"
 dependencies = [
  "dope-quic",
  "sark",
@@ -1100,9 +1217,9 @@ dependencies = [
 
 [[package]]
 name = "sark-json"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4f3a6140ea76e6e5497d57a968a6098a0be3701e64883ed7e4eb627384dc8a2f"
+checksum = "8ef0fb21a8d9c3fbcf1d41486d967cc5be51109b2009e2044697c6b39ef6571b"
 dependencies = [
  "http",
  "o3",
@@ -1111,9 +1228,9 @@ dependencies = [
 
 [[package]]
 name = "sark-ws"
-version = "0.6.5"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebce2b50a1ff93bedc56f4a49691e818e504228db2e697f4ac3fb18205df9a65"
+checksum = "4dc35a5e47355fd238a21431148e6a04b548fe37ba07f60a3154c112abd12ba0"
 dependencies = [
  "dope",
  "dope-extra",
@@ -1122,7 +1239,7 @@ dependencies = [
  "o3",
  "pin-project",
  "rand_chacha",
- "rand_core 0.9.5",
+ "rand_core",
  "sark-core",
 ]
 
@@ -1192,12 +1309,24 @@ dependencies = [
  "digest",
 ]
 
+[[package]]
+name = "sha3"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
+dependencies = [
+ "digest",
+ "keccak",
+]
+
 [[package]]
 name = "shin"
-version = "0.3.2"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a10cddc4d4991f721e480d80f9825b5e1113b02750f8eaa612a23b42266ff88"
+checksum = "8b289f0257618060f758866cd162ff200dbce56cc2e0d7fce421e5d6e7577d97"
 dependencies = [
+ "ml-kem",
+ "rand_core",
  "ring",
  "subtle",
 ]
@@ -1208,6 +1337,16 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
 
+[[package]]
+name = "spki"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
+dependencies = [
+ "base64ct",
+ "der",
+]
+
 [[package]]
 name = "stringprep"
 version = "0.1.5"
@@ -1301,9 +1440,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.51"
+version = "0.3.52"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
+checksum = "0e48db7b415311b615f910b3dcaa4557bcd4bf1982379c95c223fd8c2a20e210"
 dependencies = [
  "deranged",
  "num-conv",
@@ -1321,9 +1460,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.30"
+version = "0.2.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
+checksum = "c431b87111666e491a90baa837f914fb45cd5dc3c268591b0220ff5057f2085f"
 dependencies = [
  "num-conv",
  "time-core",
diff --git a/frameworks/sark/Cargo.toml b/frameworks/sark/Cargo.toml
index ef7af5dff..b09a8596e 100644
--- a/frameworks/sark/Cargo.toml
+++ b/frameworks/sark/Cargo.toml
@@ -9,24 +9,24 @@ edition = "2024"
 dope = "0.5"
 dope-gen = "0.5"
 dope-extra = "0.5"
-dope-tls = "0.6"
-dope-quic = "0.3"
+dope-tls = "0.9"
+dope-quic = "0.5"
 o3 = "0.2"
-sark = "0.6"
-sark-core = "0.6"
-sark-gen = "0.6"
-sark-ws = "0.6"
-sark-h2 = "0.6"
-sark-h3 = "0.6"
-sark-grpc = "0.6"
-sark-grpc-build = "0.6"
+sark = "0.8"
+sark-core = "0.8"
+sark-gen = "0.8"
+sark-ws = "0.8"
+sark-h2 = "0.8"
+sark-h3 = "0.8"
+sark-grpc = "0.8"
+sark-grpc-build = "0.8"
 cartel-pg = "0.3"
 cartel-redis = "0.3"
 cartel-gen = "0.3"
 tent = "0.2"
-shin = "0.3"
+shin = "0.8"
 http = "1.4"
-prost = "0.14.3"
+prost = "0.14.4"
 pin-project = "1"
 rcgen = { version = "0.14", default-features = false, features = ["aws_lc_rs", "pem"] }
 
diff --git a/frameworks/sark/httparena/src/lib.rs b/frameworks/sark/httparena/src/lib.rs
index bd2face41..40abe3d46 100644
--- a/frameworks/sark/httparena/src/lib.rs
+++ b/frameworks/sark/httparena/src/lib.rs
@@ -46,7 +46,7 @@ pub mod tls {
             },
             transport_params: Vec::new(),
             alpn_protocols,
-            ticket_secret: None,
+            ticket_keys: None,
             accept_early_data: false,
         }
     }
diff --git a/frameworks/sark/httparena/src/main.rs b/frameworks/sark/httparena/src/main.rs
index 2bc46d5d9..b6ab0a77a 100644
--- a/frameworks/sark/httparena/src/main.rs
+++ b/frameworks/sark/httparena/src/main.rs
@@ -31,7 +31,7 @@ use sark::fs::ServeDir;
 use sark::json::{Encode, Json, JsonDecode, JsonEncode, Writer};
 use sark::request::BodyLen;
 use sark::timer::{DEFAULT_HEAD_TIMEOUT, SARK_TIMER_ID, TimerHost};
-use sark_core::http::compress::Gzip;
+use sark_core::http::compress::{Brotli, Gzip};
 use sark_core::http::{LocalFrameBytes, Response};
 use sark_grpc::server::App as GrpcApp;
 use sark_h2::server::App as H2App;
@@ -114,15 +114,15 @@ fn u64_owned(n: u64) -> Owned {
     body
 }
 
-fn accepts_gzip(accept_encoding: &[u8]) -> bool {
+fn accepts(accept_encoding: &[u8], coding: &[u8]) -> bool {
     accept_encoding.split(|&b| b == b',').any(|part| {
-        let part = part.trim_ascii();
-        let coding = part
+        let c = part
+            .trim_ascii()
             .split(|&b| b == b';')
             .next()
             .unwrap_or(b"")
             .trim_ascii();
-        coding.eq_ignore_ascii_case(b"gzip")
+        c.eq_ignore_ascii_case(coding)
     })
 }
 
@@ -130,11 +130,16 @@ fn respond_json<T: JsonEncode>(value: T, accept_encoding: &[u8]) -> Response {
     let body = value.encode_json();
     let mut response = Response::ok();
     response.content_type("application/json");
-    if accepts_gzip(accept_encoding) {
+    if accepts(accept_encoding, b"gzip") {
         let compressed = Gzip::with_thread_local(|g| Shared::from(g.encode(&body).to_vec()));
         response.append_wire_header_static("content-encoding", "gzip");
         response.append_wire_header_static("vary", "accept-encoding");
         response.set_body(compressed);
+    } else if accepts(accept_encoding, b"br") {
+        let compressed = Brotli::with_thread_local(|b| Shared::from(b.encode(&body).to_vec()));
+        response.append_wire_header_static("content-encoding", "br");
+        response.append_wire_header_static("vary", "accept-encoding");
+        response.set_body(compressed);
     } else {
         response.set_body(body);
     }
@@ -311,6 +316,7 @@ struct PipelineRequest {}
 
 #[sark_gen::handler]
 #[static_response]
+#[skip(date, server)]
 fn pipeline_endpoint(_req: PipelineRequest, _state: &AppState<'_>) -> PipelineResponse {
     PipelineResponse {
         status: StatusCode::OK,
@@ -814,6 +820,7 @@ struct PortArgs {
     json_tls_bind: SocketAddr,
     h2c_bind: SocketAddr,
     h2_bind: SocketAddr,
+    h1_only: bool,
 }
 
 struct PgArgs {
@@ -908,53 +915,63 @@ fn run_thread(pg: PgArgs, ports: PortArgs, cfg: ServerCfg, ctx: launcher::Ctx) -
         std::ptr::NonNull::from(handler.date_stamp())
     };
 
-    let mut json_tls = {
-        let driver = exec.driver_mut();
-        Listener::<2, _, TlsProd>::open_in(
-            tls_app::new::<Tls>(&()),
-            listener_cfg(ports.json_tls_bind, cfg.max_conn),
-            driver,
-        )?
-    };
-    json_tls.set_cfg(Endpoint::Server(Box::new(httparena_sark::tls::config(
-        vec![b"http/1.1".to_vec()],
-    ))));
-    let tls_stamp = {
-        let handler = json_tls.handler_mut();
-        if !handler.is_timer_bound() {
-            handler.bind_timer(timer_borrow, DEFAULT_HEAD_TIMEOUT);
-        }
-        std::ptr::NonNull::from(handler.date_stamp())
-    };
+    let (json_tls, tls_stamp, h2c, h2) = if ports.h1_only {
+        (
+            None::<Listener<2, _, TlsProd>>,
+            h1_stamp,
+            None::<Listener<4, H2App<'_, BenchHandler, Identity>, IdThru>>,
+            None::<Listener<5, H2App<'_, BenchHandler, Tls>, TlsThru>>,
+        )
+    } else {
+        let mut json_tls = {
+            let driver = exec.driver_mut();
+            Listener::<2, _, TlsProd>::open_in(
+                tls_app::new::<Tls>(&()),
+                listener_cfg(ports.json_tls_bind, cfg.max_conn),
+                driver,
+            )?
+        };
+        json_tls.set_cfg(Endpoint::Server(Box::new(httparena_sark::tls::config(
+            vec![b"http/1.1".to_vec()],
+        ))));
+        let tls_stamp = {
+            let handler = json_tls.handler_mut();
+            if !handler.is_timer_bound() {
+                handler.bind_timer(timer_borrow, DEFAULT_HEAD_TIMEOUT);
+            }
+            std::ptr::NonNull::from(handler.date_stamp())
+        };
 
-    let h2c = {
-        let driver = exec.driver_mut();
-        Listener::<4, H2App<'_, BenchHandler, Identity>, IdThru>::open_in(
-            H2App::new(&h2c_handler),
-            listener_cfg(ports.h2c_bind, cfg.max_conn),
-            driver,
-        )?
-    };
+        let h2c = {
+            let driver = exec.driver_mut();
+            Listener::<4, H2App<'_, BenchHandler, Identity>, IdThru>::open_in(
+                H2App::new(&h2c_handler),
+                listener_cfg(ports.h2c_bind, cfg.max_conn),
+                driver,
+            )?
+        };
 
-    let mut h2 = {
-        let driver = exec.driver_mut();
-        Listener::<5, H2App<'_, BenchHandler, Tls>, TlsThru>::open_in(
-            H2App::new(&h2_handler),
-            listener_cfg(ports.h2_bind, cfg.max_conn),
-            driver,
-        )?
+        let mut h2 = {
+            let driver = exec.driver_mut();
+            Listener::<5, H2App<'_, BenchHandler, Tls>, TlsThru>::open_in(
+                H2App::new(&h2_handler),
+                listener_cfg(ports.h2_bind, cfg.max_conn),
+                driver,
+            )?
+        };
+        h2.set_cfg(Endpoint::Server(Box::new(httparena_sark::tls::config(
+            vec![b"h2".to_vec()],
+        ))));
+        (Some(json_tls), tls_stamp, Some(h2c), Some(h2))
     };
-    h2.set_cfg(Endpoint::Server(Box::new(httparena_sark::tls::config(
-        vec![b"h2".to_vec()],
-    ))));
 
     let mut init = app.as_mut().project();
     init.date_h1.as_mut().get_mut().bind(h1_stamp);
     init.date_tls.as_mut().get_mut().bind(tls_stamp);
     init.p8080.set(Some(http));
-    init.json_tls.set(Some(json_tls));
-    init.h2c.set(Some(h2c));
-    init.p8443.set(Some(h2));
+    init.json_tls.set(json_tls);
+    init.h2c.set(h2c);
+    init.p8443.set(h2);
     exec.run(app.as_mut())
 }
 
@@ -979,11 +996,15 @@ fn main() -> io::Result<()> {
             .precompressed_gzip(),
     ));
 
+    let h1_only = std::env::var("SARK_HTTPARENA_H1_ONLY")
+        .map(|v| v == "1" || v.eq_ignore_ascii_case("true"))
+        .unwrap_or(false);
     let ports = PortArgs {
         h1_bind: boot.bind,
         json_tls_bind: SocketAddr::from(([0, 0, 0, 0], 8081)),
         h2c_bind: SocketAddr::from(([0, 0, 0, 0], 8082)),
         h2_bind: SocketAddr::from(([0, 0, 0, 0], 8443)),
+        h1_only,
     };
 
     let cfg = ServerCfg {
@@ -1006,6 +1027,7 @@ fn main() -> io::Result<()> {
             json_tls_bind: ports.json_tls_bind,
             h2c_bind: ports.h2c_bind,
             h2_bind: ports.h2_bind,
+            h1_only: ports.h1_only,
         };
         run_thread(pg, ports, cfg.clone(), ctx)
     })
diff --git a/site/data/gateway-64-1024.json b/site/data/gateway-64-1024.json
index 4a047ced8..efb50013d 100644
--- a/site/data/gateway-64-1024.json
+++ b/site/data/gateway-64-1024.json
@@ -22,6 +22,30 @@
     "tpl_json": 415773,
     "tpl_async_db": 178188
   },
+  {
+    "framework": "sark",
+    "language": "Rust",
+    "rps": 73267,
+    "avg_latency": "353.29ms",
+    "p99_latency": "4.65s",
+    "cpu": "4305.8%",
+    "memory": "4.9GiB",
+    "connections": 1024,
+    "threads": 64,
+    "duration": "5s",
+    "pipeline": 1,
+    "bandwidth": "894.54MB/s",
+    "reconnects": 0,
+    "status_2xx": 370736,
+    "status_3xx": 0,
+    "status_4xx": 0,
+    "status_5xx": 11282,
+    "tpl_static": 111220,
+    "tpl_baseline": 74147,
+    "tpl_json": 129757,
+    "tpl_async_db": 55610,
+    "cpu_breakdown": "proxy: 3957% 4.3GiB | server: 349% 602MiB"
+  },
   {
     "framework": "trillium",
     "language": "Rust",
diff --git a/site/data/gateway-64-512.json b/site/data/gateway-64-512.json
index 3846e1a55..42c0301e0 100644
--- a/site/data/gateway-64-512.json
+++ b/site/data/gateway-64-512.json
@@ -22,6 +22,30 @@
     "tpl_json": 552856,
     "tpl_async_db": 236938
   },
+  {
+    "framework": "sark",
+    "language": "Rust",
+    "rps": 107499,
+    "avg_latency": "142.24ms",
+    "p99_latency": "2.23s",
+    "cpu": "4529.5%",
+    "memory": "2.8GiB",
+    "connections": 512,
+    "threads": 64,
+    "duration": "5s",
+    "pipeline": 1,
+    "bandwidth": "1.18GB/s",
+    "reconnects": 0,
+    "status_2xx": 541798,
+    "status_3xx": 0,
+    "status_4xx": 0,
+    "status_5xx": 0,
+    "tpl_static": 162539,
+    "tpl_baseline": 108359,
+    "tpl_json": 189629,
+    "tpl_async_db": 81269,
+    "cpu_breakdown": "proxy: 4000% 2.2GiB | server: 530% 586MiB"
+  },
   {
     "framework": "trillium",
     "language": "Rust",
diff --git a/site/data/gateway-h3-256.json b/site/data/gateway-h3-256.json
index 93572d1df..fb9b1dc1e 100644
--- a/site/data/gateway-h3-256.json
+++ b/site/data/gateway-h3-256.json
@@ -23,6 +23,30 @@
     "tpl_async_db": 42509,
     "cpu_breakdown": "server: 656% 180MiB | proxy: 1815% 1.4GiB"
   },
+  {
+    "framework": "sark",
+    "language": "Rust",
+    "rps": 63434,
+    "avg_latency": "125.55ms",
+    "p99_latency": "733.02ms",
+    "cpu": "2079.4%",
+    "memory": "2.2GiB",
+    "connections": 256,
+    "threads": 64,
+    "duration": "5s",
+    "pipeline": 1,
+    "bandwidth": "672.55MB/s",
+    "reconnects": 0,
+    "status_2xx": 319076,
+    "status_3xx": 0,
+    "status_4xx": 0,
+    "status_5xx": 0,
+    "tpl_static": 95722,
+    "tpl_baseline": 63815,
+    "tpl_json": 111676,
+    "tpl_async_db": 47861,
+    "cpu_breakdown": "server: 279% 467MiB | proxy: 1801% 1.7GiB"
+  },
   {
     "framework": "trillium",
     "language": "Rust",
diff --git a/site/data/gateway-h3-64.json b/site/data/gateway-h3-64.json
index be74257ba..02609230e 100644
--- a/site/data/gateway-h3-64.json
+++ b/site/data/gateway-h3-64.json
@@ -23,6 +23,30 @@
     "tpl_async_db": 62371,
     "cpu_breakdown": "server: 845% 226MiB | proxy: 2628% 578MiB"
   },
+  {
+    "framework": "sark",
+    "language": "Rust",
+    "rps": 93655,
+    "avg_latency": "21.75ms",
+    "p99_latency": "82.76ms",
+    "cpu": "3197.3%",
+    "memory": "907MiB",
+    "connections": 64,
+    "threads": 64,
+    "duration": "5s",
+    "pipeline": 1,
+    "bandwidth": "1015.09MB/s",
+    "reconnects": 0,
+    "status_2xx": 469213,
+    "status_3xx": 0,
+    "status_4xx": 0,
+    "status_5xx": 0,
+    "tpl_static": 140763,
+    "tpl_baseline": 93842,
+    "tpl_json": 164224,
+    "tpl_async_db": 70381,
+    "cpu_breakdown": "server: 404% 478MiB | proxy: 2793% 430MiB"
+  },
   {
     "framework": "trillium",
     "language": "Rust",
diff --git a/site/static/logs/gateway-64/1024/sark-gateway.log b/site/static/logs/gateway-64/1024/sark-gateway.log
new file mode 100644
index 000000000..13f124cc8
--- /dev/null
+++ b/site/static/logs/gateway-64/1024/sark-gateway.log
@@ -0,0 +1 @@
+Error response from daemon: No such container: httparena-bench-sark-gateway
diff --git a/site/static/logs/gateway-64/512/sark-gateway.log b/site/static/logs/gateway-64/512/sark-gateway.log
new file mode 100644
index 000000000..13f124cc8
--- /dev/null
+++ b/site/static/logs/gateway-64/512/sark-gateway.log
@@ -0,0 +1 @@
+Error response from daemon: No such container: httparena-bench-sark-gateway
diff --git a/site/static/logs/gateway-h3/256/sark-gateway.log b/site/static/logs/gateway-h3/256/sark-gateway.log
new file mode 100644
index 000000000..13f124cc8
--- /dev/null
+++ b/site/static/logs/gateway-h3/256/sark-gateway.log
@@ -0,0 +1 @@
+Error response from daemon: No such container: httparena-bench-sark-gateway
diff --git a/site/static/logs/gateway-h3/64/sark-gateway.log b/site/static/logs/gateway-h3/64/sark-gateway.log
new file mode 100644
index 000000000..13f124cc8
--- /dev/null
+++ b/site/static/logs/gateway-h3/64/sark-gateway.log
@@ -0,0 +1 @@
+Error response from daemon: No such container: httparena-bench-sark-gateway