diff --git a/Cargo.lock b/Cargo.lock
index 3ca8da35..b6b1966c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4564,13 +4564,13 @@ dependencies = [
  "async-nats",
  "clap",
  "data-encoding",
- "futures",
+ "futures-util",
  "nats-jwt",
  "nkeys",
  "reqwest 0.13.1",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "tokio",
  "tracing",
  "tracing-subscriber",
diff --git a/Cargo.toml b/Cargo.toml
index cb0b4417..5b85aa74 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -140,5 +140,22 @@ matrix-sdk = { version = "0.18", default-features = false, features = [
 futures-util = "0.3"
 hmac = "0.13"
 sha2 = "0.11"
+# The NATS protocol client, for the swarm queue's auth-callout responder.
+# `default-features = false` because the default set is broad - jetstream, kv,
+# object-store, websockets, service - and a callout responder speaks none of
+# them. What is named is the whole requirement: the server generation we
+# deploy, nkey auth, and a TLS backend.
+async-nats = { version = "0.50", default-features = false, features = [
+  "server_2_14",
+  "nkeys",
+  "ring",
+] }
+data-encoding = "2"
+# The nkey *format* - ed25519 + base32 + CRC16. The primitives are already in
+# the tree; the format is not, and hand-rolling a key format on an auth path
+# is how you get a CRC bug nobody reviews.
+nkeys = "0.4"
+# A TEST ORACLE, not a runtime dependency - see swarm-nats-auth's respond.rs.
+nats-jwt = "0.3"
 utoipa = { version = "5", features = ["axum_extras", "chrono"] }
 utoipa-axum = "0.2"
diff --git a/swarm-nats-auth/Cargo.toml b/swarm-nats-auth/Cargo.toml
index 6677312a..d85f10d5 100644
--- a/swarm-nats-auth/Cargo.toml
+++ b/swarm-nats-auth/Cargo.toml
@@ -10,37 +10,21 @@ path = "src/main.rs"
 
 [dependencies]
 anyhow.workspace = true
+async-nats.workspace = true
 clap.workspace = true
+# base64url for decoding the inbound request JWT.
+data-encoding.workspace = true
+# StreamExt::next on the subscription: async-nats returns a Stream.
+futures-util.workspace = true
+nkeys.workspace = true
 reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
+# The jti digest: base32hex(sha256(claims)) over every JWT this crate signs.
+sha2.workspace = true
 tokio.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
-# The NATS protocol client. `default-features = false` because the default set
-# is broad - jetstream, kv, object-store, websockets, service - and a callout
-# responder speaks none of them. What is named here is the whole requirement:
-# the server generation we actually deploy, nkey auth, and a TLS backend.
-# (Checked what dropping the defaults costs, the way `internal-logs` was once
-# lost that way: nothing in the unused set is a diagnostic.)
-async-nats = { version = "0.50", default-features = false, features = [
-  "server_2_14",
-  "nkeys",
-  "ring",
-] }
-# base64url for decoding the inbound request JWT. Already in the tree via
-# nkeys; named directly because this crate uses it directly.
-data-encoding = "2"
-# StreamExt::next on the subscription. async-nats returns a Stream, not an
-# iterator, and futures is already in the tree.
-futures = "0.3"
-# nkey seed handling + signing. The primitives (ed25519-dalek, data-encoding)
-# are already in the tree, but the nkey *format* - ed25519 + base32 + CRC16 -
-# is not, and hand-rolling a key format on an auth path is how you get a
-# CRC bug nobody reviews.
-nkeys = "0.4"
-# The jti digest: base32hex(sha256(claims)) over every JWT this crate signs.
-sha2 = "0.10"
 
 [dev-dependencies]
 # A TEST ORACLE, not part of the production path. Neither JWT this crate emits
@@ -51,7 +35,7 @@ sha2 = "0.10"
 # is checked *against*: `respond::tests::hand_built_matches_the_reference`
 # builds a user token both ways and requires byte equality, on the one shape
 # nats-jwt does model.
-nats-jwt = "0.3"
+nats-jwt.workspace = true
 
 [lints]
 workspace = true
diff --git a/swarm-nats-auth/src/main.rs b/swarm-nats-auth/src/main.rs
index 94217902..fa948747 100644
--- a/swarm-nats-auth/src/main.rs
+++ b/swarm-nats-auth/src/main.rs
@@ -25,7 +25,7 @@ use std::path::PathBuf;
 
 use anyhow::Context;
 use clap::Parser;
-use futures::StreamExt;
+use futures_util::StreamExt;
 
 mod introspect;
 mod request;