diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index f3be9b6f80..163d95f026 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -49,10 +49,10 @@ jobs:
       CXX: "/usr/bin/clang++-14"
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab
+      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
       - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --no-run
       - run: cargo tarpaulin --locked --workspace --exclude=linkerd2-proxy --exclude=linkerd-transport-header --exclude=opencensus-proto --exclude=spire-proto --skip-clean --ignore-tests --no-fail-fast --out=Xml
         # Some tests are especially flakey in coverage tests. That's fine. We
         # only really care to measure how much of our codebase is covered.
         continue-on-error: true
-      - uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e
+      - uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
index 88eecdc8f5..35a80829b7 100644
--- a/.github/workflows/markdown.yml
+++ b/.github/workflows/markdown.yml
@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: DavidAnson/markdownlint-cli2-action@eb5ca3ab411449c66620fe7f1b3c9e10547144b0
+      - uses: DavidAnson/markdownlint-cli2-action@a23dae216ce3fee4db69da41fed90d2a4af801cf
         with:
             globs: "**/*.md"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9c580c47ee..eb668bec4e 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -92,7 +92,7 @@ jobs:
     steps:
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab
+      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
       - run: just fetch
       - name: Run cargo deny check bans licenses sources
         uses: EmbarkStudios/cargo-deny-action@e2f4ede4a4e60ea15ff31bc0647485d80c66cfba
@@ -118,7 +118,7 @@ jobs:
     steps:
       - run: git config --global --add safe.directory "$PWD" # actions/runner#2033
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
-      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab
+      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
       - run: just fetch
       - run: just check-crate ${{ matrix.crate }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4768072d88..a6106a902a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -143,7 +143,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with:
           ref: ${{ needs.meta.outputs.ref }}
-      - uses: Swatinem/rust-cache@82a92a6e8fbeee089604da2575dc567ae9ddeaab
+      - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3
         with:
           key: ${{ matrix.arch }}
       - run: just fetch
diff --git a/Cargo.lock b/Cargo.lock
index c9324f6cce..aa1287dcbe 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -62,9 +62,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.94"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
 
 [[package]]
 name = "arbitrary"
@@ -317,9 +317,9 @@ checksum = "325918d6fe32f23b19878fe4b34794ae41fc19ddbe53b10571a4874d44ffd39b"
 
 [[package]]
 name = "cc"
-version = "1.2.4"
+version = "1.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9157bbaa6b165880c27a4293a474c91cdcf265cc68cc829bf10be0964a391caf"
+checksum = "c31a0499c1dc64f458ad13872de75c0eb7e3fdb0e67964610c914b034fc5956e"
 dependencies = [
  "jobserver",
  "libc",
@@ -1246,9 +1246,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.168"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5aaeb2981e0606ca11d79718f8bb01164f1d6ed75080182d3abf017e6d244b6d"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "libfuzzer-sys"
@@ -1860,6 +1860,7 @@ dependencies = [
  "hyper",
  "linkerd-duplex",
  "linkerd-error",
+ "linkerd-http-box",
  "linkerd-http-version",
  "linkerd-io",
  "linkerd-stack",
@@ -2907,9 +2908,9 @@ dependencies = [
 
 [[package]]
 name = "object"
-version = "0.36.5"
+version = "0.36.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
+checksum = "62948e14d923ea95ea2c7c86c71013138b66525b86bdc08d2dcc262bdb497b87"
 dependencies = [
  "memchr",
 ]
@@ -3629,9 +3630,9 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "symbolic-common"
-version = "12.12.3"
+version = "12.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e5ba5365997a4e375660bed52f5b42766475d5bc8ceb1bb13fea09c469ea0f49"
+checksum = "cd33e73f154e36ec223c18013f7064a2c120f1162fc086ac9933542def186b00"
 dependencies = [
  "debugid",
  "memmap2",
@@ -3641,9 +3642,9 @@ dependencies = [
 
 [[package]]
 name = "symbolic-demangle"
-version = "12.12.3"
+version = "12.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "beff338b2788519120f38c59ff4bb15174f52a183e547bac3d6072c2c0aa48aa"
+checksum = "89e51191290147f071777e37fe111800bb82a9059f9c95b19d2dd41bfeddf477"
 dependencies = [
  "cpp_demangle",
  "rustc-demangle",
@@ -3652,9 +3653,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.90"
+version = "2.0.94"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
+checksum = "987bc0be1cdea8b10216bd06e2ca407d40b9543468fafd3ddfb02f36e77f71f3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3794,9 +3795,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.8.0"
+version = "1.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "445e881f4f6d382d5f27c034e25eb92edd7c784ceab92a0937db7f2e9471b938"
+checksum = "022db8904dfa342efe721985167e9fcd16c29b226db4397ed752a761cfce81e8"
 dependencies = [
  "tinyvec_macros",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 7bc4b93451..5f65dfabc5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -97,9 +97,21 @@ debug = 1
 lto = true
 
 [workspace.dependencies]
+bytes = { version = "1" }
+h2 = { version = "0.3" }
 http = { version = "0.2" }
 http-body = { version = "0.4" }
 hyper = { version = "0.14.32", default-features = false }
-linkerd2-proxy-api = "0.15.0"
-tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging"] }
-# linkerd2-proxy-api = { git = "https://github.com/linkerd/linkerd2-proxy-api.git", branch = "main" }
+prost = { version = "0.12" }
+prost-types = { version = "0.12" }
+tokio-rustls = { version = "0.26", default-features = false, features = [
+    "ring",
+    "logging",
+] }
+tonic = { version = "0.10", default-features = false }
+tonic-build = { version = "0.10", default-features = false }
+
+[workspace.dependencies.linkerd2-proxy-api]
+version = "0.15.0"
+# git = "https://github.com/linkerd/linkerd2-proxy-api.git"
+# branch = "main"
diff --git a/linkerd/app/Cargo.toml b/linkerd/app/Cargo.toml
index 9dd3f86f49..572f5089c2 100644
--- a/linkerd/app/Cargo.toml
+++ b/linkerd/app/Cargo.toml
@@ -32,6 +32,6 @@ regex = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["rt"] }
 tokio-stream = { version = "0.1", features = ["time", "sync"] }
-tonic = { version = "0.10", default-features = false, features = ["prost"] }
+tonic = { workspace = true, default-features = false, features = ["prost"] }
 tower = "0.4"
 tracing = "0.1"
diff --git a/linkerd/app/admin/Cargo.toml b/linkerd/app/admin/Cargo.toml
index a347c015b1..a800578bd1 100644
--- a/linkerd/app/admin/Cargo.toml
+++ b/linkerd/app/admin/Cargo.toml
@@ -15,7 +15,7 @@ pprof = ["deflate", "dep:pprof"]
 log-streaming = ["linkerd-tracing/stream"]
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 deflate = { version = "1", optional = true, features = ["gzip"] }
 http = { workspace = true }
 http-body = { workspace = true }
diff --git a/linkerd/app/core/Cargo.toml b/linkerd/app/core/Cargo.toml
index 08200aa6dd..02db292ac8 100644
--- a/linkerd/app/core/Cargo.toml
+++ b/linkerd/app/core/Cargo.toml
@@ -13,7 +13,7 @@ independently of the inbound and outbound proxy logic.
 """
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 drain = { version = "0.1", features = ["retain"] }
 http = { workspace = true }
 http-body = { workspace = true }
@@ -26,7 +26,7 @@ serde_json = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["macros", "sync", "parking_lot"] }
 tokio-stream = { version = "0.1", features = ["time"] }
-tonic = { version = "0.10", default-features = false, features = ["prost"] }
+tonic = { workspace = true, default-features = false, features = ["prost"] }
 tracing = "0.1"
 parking_lot = "0.12"
 pin-project = "1"
diff --git a/linkerd/app/core/build.rs b/linkerd/app/core/build.rs
index e1db4f96de..0aefc19d95 100644
--- a/linkerd/app/core/build.rs
+++ b/linkerd/app/core/build.rs
@@ -14,8 +14,8 @@ fn set_env(name: &str, cmd: &mut Command) {
 fn version() -> String {
     if let Ok(v) = std::env::var("LINKERD2_PROXY_VERSION") {
         if !v.is_empty() {
-            if semver::Version::parse(&v).is_err() {
-                panic!("LINKERD2_PROXY_VERSION must be semver");
+            if let Err(err) = semver::Version::parse(&v) {
+                panic!("LINKERD2_PROXY_VERSION must be semver: version='{v}' error='{err}'");
             }
             return v;
         }
diff --git a/linkerd/app/gateway/Cargo.toml b/linkerd/app/gateway/Cargo.toml
index a802963f57..830287db60 100644
--- a/linkerd/app/gateway/Cargo.toml
+++ b/linkerd/app/gateway/Cargo.toml
@@ -16,7 +16,7 @@ linkerd-proxy-client-policy = { path = "../../proxy/client-policy" }
 once_cell = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["sync"] }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tower = { version = "0.4", default-features = false }
 tracing = "0.1"
 
diff --git a/linkerd/app/inbound/Cargo.toml b/linkerd/app/inbound/Cargo.toml
index e72cbd1524..46d849353c 100644
--- a/linkerd/app/inbound/Cargo.toml
+++ b/linkerd/app/inbound/Cargo.toml
@@ -18,7 +18,7 @@ test-util = [
 ]
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 http = { workspace = true }
 futures = { version = "0.3", default-features = false }
 linkerd-app-core = { path = "../core" }
@@ -36,7 +36,7 @@ parking_lot = "0.12"
 rangemap = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["sync"] }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tower = { version = "0.4", features = ["util"] }
 tracing = "0.1"
 
diff --git a/linkerd/app/integration/Cargo.toml b/linkerd/app/integration/Cargo.toml
index 5e5dd751a7..6b615ede73 100644
--- a/linkerd/app/integration/Cargo.toml
+++ b/linkerd/app/integration/Cargo.toml
@@ -17,9 +17,9 @@ default = []
 flakey = []
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false, features = ["executor"] }
-h2 = "0.3"
+h2 = { workspace = true }
 http = { workspace = true }
 http-body = { workspace = true }
 hyper = { workspace = true, features = [
@@ -50,7 +50,7 @@ tokio-stream = { version = "0.1", features = ["sync"] }
 tokio-rustls = { workspace = true }
 rustls-pemfile = "2.2"
 tower = { version = "0.4", default-features = false }
-tonic = { version = "0.10", features = ["transport"], default-features = false }
+tonic = { workspace = true, features = ["transport"], default-features = false }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", default-features = false, features = [
     "fmt",
diff --git a/linkerd/app/outbound/Cargo.toml b/linkerd/app/outbound/Cargo.toml
index 646684c8f2..cfa7103d60 100644
--- a/linkerd/app/outbound/Cargo.toml
+++ b/linkerd/app/outbound/Cargo.toml
@@ -19,7 +19,7 @@ prometheus-client-rust-242 = [] # TODO
 
 [dependencies]
 ahash = "0.8"
-bytes = "1"
+bytes = { workspace = true }
 http = { workspace = true }
 futures = { version = "0.3", default-features = false }
 linkerd2-proxy-api = { workspace = true, features = ["outbound"] }
@@ -29,7 +29,7 @@ pin-project = "1"
 prometheus-client = "0.22"
 thiserror = "2"
 tokio = { version = "1", features = ["sync"] }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tower = { version = "0.4", features = ["util"] }
 tracing = "0.1"
 
diff --git a/linkerd/app/test/Cargo.toml b/linkerd/app/test/Cargo.toml
index 2c6aa923be..a58afcef7e 100644
--- a/linkerd/app/test/Cargo.toml
+++ b/linkerd/app/test/Cargo.toml
@@ -14,7 +14,7 @@ client-policy = ["linkerd-proxy-client-policy", "tonic", "linkerd-http-route"]
 
 [dependencies]
 futures = { version = "0.3", default-features = false }
-h2 = "0.3"
+h2 = { workspace = true }
 http = { workspace = true }
 http-body = { workspace = true }
 hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
@@ -29,7 +29,7 @@ regex = "1"
 tokio = { version = "1", features = ["io-util", "net", "rt", "sync"] }
 tokio-test = "0.4"
 tokio-stream = { version = "0.1", features = ["sync"] }
-tonic = { version = "0.10", default-features = false, optional = true }
+tonic = { workspace = true, default-features = false, optional = true }
 tower = { version = "0.4", default-features = false }
 tracing = "0.1"
 thiserror = "2"
diff --git a/linkerd/detect/Cargo.toml b/linkerd/detect/Cargo.toml
index 4ca72b7e32..ce68f152ba 100644
--- a/linkerd/detect/Cargo.toml
+++ b/linkerd/detect/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 async-trait = "0.1"
-bytes = "1"
+bytes = { workspace = true }
 linkerd-error = { path = "../error" }
 linkerd-io = { path = "../io" }
 linkerd-stack = { path = "../stack" }
diff --git a/linkerd/duplex/Cargo.toml b/linkerd/duplex/Cargo.toml
index a0fe62f89b..b2fc9ed01b 100644
--- a/linkerd/duplex/Cargo.toml
+++ b/linkerd/duplex/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2021"
 publish = false
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 tokio = { version = "1", features = ["io-util"] }
 pin-project = "1"
diff --git a/linkerd/http/box/Cargo.toml b/linkerd/http/box/Cargo.toml
index 4decfe41a0..42d5ec6d50 100644
--- a/linkerd/http/box/Cargo.toml
+++ b/linkerd/http/box/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2021"
 publish = false
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
diff --git a/linkerd/http/metrics/Cargo.toml b/linkerd/http/metrics/Cargo.toml
index 92d68e5385..02c1e87a88 100644
--- a/linkerd/http/metrics/Cargo.toml
+++ b/linkerd/http/metrics/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 test-util = []
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
diff --git a/linkerd/http/prom/Cargo.toml b/linkerd/http/prom/Cargo.toml
index baf89b72bd..360ea12141 100644
--- a/linkerd/http/prom/Cargo.toml
+++ b/linkerd/http/prom/Cargo.toml
@@ -13,7 +13,7 @@ Tower middleware for Prometheus metrics.
 test-util = []
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
diff --git a/linkerd/http/retry/Cargo.toml b/linkerd/http/retry/Cargo.toml
index ba93bc987e..a59da0d9ab 100644
--- a/linkerd/http/retry/Cargo.toml
+++ b/linkerd/http/retry/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2021"
 publish = false
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http-body = { workspace = true }
 http = { workspace = true }
diff --git a/linkerd/http/upgrade/Cargo.toml b/linkerd/http/upgrade/Cargo.toml
index 5e609edf60..1787fddb6e 100644
--- a/linkerd/http/upgrade/Cargo.toml
+++ b/linkerd/http/upgrade/Cargo.toml
@@ -10,7 +10,7 @@ Facilities for HTTP/1 upgrades.
 """
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 drain = "0.1"
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
@@ -24,6 +24,7 @@ try-lock = "0.2"
 
 linkerd-duplex = { path = "../../duplex" }
 linkerd-error = { path = "../../error" }
+linkerd-http-box = { path = "../box" }
 linkerd-http-version = { path = "../version" }
 linkerd-io = { path = "../../io" }
 linkerd-stack = { path = "../../stack" }
diff --git a/linkerd/http/upgrade/src/glue.rs b/linkerd/http/upgrade/src/glue.rs
index 2e7ac2d7da..9557fc9d86 100644
--- a/linkerd/http/upgrade/src/glue.rs
+++ b/linkerd/http/upgrade/src/glue.rs
@@ -1,9 +1,9 @@
 use crate::upgrade::Http11Upgrade;
-use bytes::Bytes;
-use futures::TryFuture;
+use futures::{ready, TryFuture};
 use http_body::Body;
 use hyper::client::connect as hyper_connect;
 use linkerd_error::{Error, Result};
+use linkerd_http_box::BoxBody;
 use linkerd_io::{self as io, AsyncRead, AsyncWrite};
 use linkerd_stack::{MakeConnection, Service};
 use pin_project::{pin_project, pinned_drop};
@@ -17,10 +17,11 @@ use tracing::debug;
 /// Provides optional HTTP/1.1 upgrade support on the body.
 #[pin_project(PinnedDrop)]
 #[derive(Debug)]
-pub struct UpgradeBody {
+pub struct UpgradeBody<B = BoxBody> {
     /// In UpgradeBody::drop, if this was an HTTP upgrade, the body is taken
     /// to be inserted into the Http11Upgrade half.
-    body: hyper::Body,
+    #[pin]
+    body: B,
     pub(super) upgrade: Option<(Http11Upgrade, hyper::upgrade::OnUpgrade)>,
 }
 
@@ -50,9 +51,13 @@ pub struct HyperConnectFuture<F> {
 
 // === impl UpgradeBody ===
 
-impl Body for UpgradeBody {
-    type Data = Bytes;
-    type Error = hyper::Error;
+impl<B> Body for UpgradeBody<B>
+where
+    B: Body,
+    B::Error: std::fmt::Display,
+{
+    type Data = B::Data;
+    type Error = B::Error;
 
     fn is_end_stream(&self) -> bool {
         self.body.is_end_stream()
@@ -62,28 +67,34 @@ impl Body for UpgradeBody {
         self: Pin<&mut Self>,
         cx: &mut Context<'_>,
     ) -> Poll<Option<Result<Self::Data, Self::Error>>> {
-        let body = self.project().body;
-        let poll = futures::ready!(Pin::new(body) // `hyper::Body` is Unpin
-            .poll_data(cx));
-        Poll::Ready(poll.map(|x| {
-            x.map_err(|e| {
-                debug!("http body error: {}", e);
-                e
-            })
-        }))
+        // Poll the next chunk from the body.
+        let this = self.project();
+        let body = this.body;
+        let data = ready!(body.poll_data(cx));
+
+        // Log errors.
+        if let Some(Err(e)) = &data {
+            debug!("http body error: {}", e);
+        }
+
+        Poll::Ready(data)
     }
 
     fn poll_trailers(
         self: Pin<&mut Self>,
         cx: &mut Context<'_>,
     ) -> Poll<Result<Option<http::HeaderMap>, Self::Error>> {
-        let body = self.project().body;
-        Pin::new(body) // `hyper::Body` is Unpin
-            .poll_trailers(cx)
-            .map_err(|e| {
-                debug!("http trailers error: {}", e);
-                e
-            })
+        // Poll the trailers from the body.
+        let this = self.project();
+        let body = this.body;
+        let trailers = ready!(body.poll_trailers(cx));
+
+        // Log errors.
+        if let Err(e) = &trailers {
+            debug!("http trailers error: {}", e);
+        }
+
+        Poll::Ready(trailers)
     }
 
     #[inline]
@@ -92,32 +103,23 @@ impl Body for UpgradeBody {
     }
 }
 
-impl Default for UpgradeBody {
+impl<B: Default> Default for UpgradeBody<B> {
     fn default() -> Self {
-        hyper::Body::empty().into()
-    }
-}
-
-impl From<hyper::Body> for UpgradeBody {
-    fn from(body: hyper::Body) -> Self {
         Self {
-            body,
+            body: B::default(),
             upgrade: None,
         }
     }
 }
 
-impl UpgradeBody {
-    pub fn new(
-        body: hyper::Body,
-        upgrade: Option<(Http11Upgrade, hyper::upgrade::OnUpgrade)>,
-    ) -> Self {
+impl<B> UpgradeBody<B> {
+    pub fn new(body: B, upgrade: Option<(Http11Upgrade, hyper::upgrade::OnUpgrade)>) -> Self {
         Self { body, upgrade }
     }
 }
 
 #[pinned_drop]
-impl PinnedDrop for UpgradeBody {
+impl<B> PinnedDrop for UpgradeBody<B> {
     fn drop(self: Pin<&mut Self>) {
         let this = self.project();
         // If an HTTP/1 upgrade was wanted, send the upgrade future.
@@ -164,6 +166,8 @@ where
     }
 }
 
+// === impl HyperConnectFuture ===
+
 impl<F, I, M> Future for HyperConnectFuture<F>
 where
     F: TryFuture<Ok = (I, M)> + 'static,
@@ -181,7 +185,7 @@ where
     }
 }
 
-// === impl Connected ===
+// === impl Connection ===
 
 impl<C> AsyncRead for Connection<C>
 where
diff --git a/linkerd/http/upgrade/src/upgrade.rs b/linkerd/http/upgrade/src/upgrade.rs
index 1094584f83..3d6975472f 100644
--- a/linkerd/http/upgrade/src/upgrade.rs
+++ b/linkerd/http/upgrade/src/upgrade.rs
@@ -174,20 +174,20 @@ impl<S> Service<S> {
 
 type ResponseFuture<F, B, E> = Either<F, future::Ready<Result<http::Response<B>, E>>>;
 
-impl<S, B> tower::Service<http::Request<hyper::Body>> for Service<S>
+impl<S, ReqB, RespB> tower::Service<http::Request<ReqB>> for Service<S>
 where
-    S: tower::Service<http::Request<UpgradeBody>, Response = http::Response<B>>,
-    B: Default,
+    S: tower::Service<http::Request<UpgradeBody<ReqB>>, Response = http::Response<RespB>>,
+    RespB: Default,
 {
     type Response = S::Response;
     type Error = S::Error;
-    type Future = ResponseFuture<S::Future, B, S::Error>;
+    type Future = ResponseFuture<S::Future, RespB, S::Error>;
 
     fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
         self.service.poll_ready(cx)
     }
 
-    fn call(&mut self, mut req: http::Request<hyper::Body>) -> Self::Future {
+    fn call(&mut self, mut req: http::Request<ReqB>) -> Self::Future {
         // Should this rejection happen later in the Service stack?
         //
         // Rejecting here means telemetry doesn't record anything about it...
diff --git a/linkerd/io/Cargo.toml b/linkerd/io/Cargo.toml
index b255f40780..0f68e6545d 100644
--- a/linkerd/io/Cargo.toml
+++ b/linkerd/io/Cargo.toml
@@ -15,7 +15,7 @@ default = []
 [dependencies]
 async-trait = "0.1"
 futures = { version = "0.3", default-features = false }
-bytes = "1"
+bytes = { workspace = true }
 linkerd-errno = { path = "../errno" }
 tokio = { version = "1", features = ["io-util", "net"] }
 tokio-test = { version = "0.4", optional = true }
diff --git a/linkerd/opencensus/Cargo.toml b/linkerd/opencensus/Cargo.toml
index dbe267d477..bd29ae156a 100644
--- a/linkerd/opencensus/Cargo.toml
+++ b/linkerd/opencensus/Cargo.toml
@@ -14,7 +14,7 @@ linkerd-error = { path = "../error" }
 linkerd-metrics = { path = "../metrics" }
 linkerd-trace-context = { path = "../trace-context" }
 opencensus-proto = { path = "../../opencensus-proto" }
-tonic = { version = "0.10", default-features = false, features = [
+tonic = { workspace = true, default-features = false, features = [
     "prost",
     "codegen",
 ] }
diff --git a/linkerd/opentelemetry/Cargo.toml b/linkerd/opentelemetry/Cargo.toml
index 62c4608a50..647a0efc81 100644
--- a/linkerd/opentelemetry/Cargo.toml
+++ b/linkerd/opentelemetry/Cargo.toml
@@ -16,7 +16,7 @@ linkerd-trace-context = { path = "../trace-context" }
 opentelemetry = { version = "0.27", default-features = false, features = ["trace"] }
 opentelemetry_sdk = { version = "0.27", default-features = false, features = ["trace"] }
 opentelemetry-proto = { path = "../../opentelemetry-proto" }
-tonic = { version = "0.10", default-features = false, features = [
+tonic = { workspace = true, default-features = false, features = [
     "prost",
     "codegen",
 ] }
diff --git a/linkerd/proxy/api-resolve/Cargo.toml b/linkerd/proxy/api-resolve/Cargo.toml
index 2041adea9b..139a52ad89 100644
--- a/linkerd/proxy/api-resolve/Cargo.toml
+++ b/linkerd/proxy/api-resolve/Cargo.toml
@@ -23,7 +23,7 @@ linkerd-identity = { path = "../../identity" }
 http = { workspace = true }
 http-body = { workspace = true }
 pin-project = "1"
-prost = "0.12"
-tonic = { version = "0.10", default-features = false }
+prost = { workspace = true }
+tonic = { workspace = true, default-features = false }
 tower = { version = "0.4", default-features = false }
 tracing = "0.1"
diff --git a/linkerd/proxy/client-policy/Cargo.toml b/linkerd/proxy/client-policy/Cargo.toml
index a4b8f93368..c36cdef3e1 100644
--- a/linkerd/proxy/client-policy/Cargo.toml
+++ b/linkerd/proxy/client-policy/Cargo.toml
@@ -20,8 +20,8 @@ ahash = "0.8"
 ipnet = "2"
 http = { workspace = true }
 once_cell = { version = "1" }
-prost-types = { version = "0.12", optional = true }
-tonic = { version = "0.10", default-features = false }
+prost-types = { workspace = true, optional = true }
+tonic = { workspace = true, default-features = false }
 thiserror = { version = "2", optional = true }
 
 linkerd-error = { path = "../../error" }
diff --git a/linkerd/proxy/http/Cargo.toml b/linkerd/proxy/http/Cargo.toml
index 63874213c4..5905e94dad 100644
--- a/linkerd/proxy/http/Cargo.toml
+++ b/linkerd/proxy/http/Cargo.toml
@@ -13,10 +13,10 @@ This should probably be decomposed into smaller, decoupled crates.
 
 [dependencies]
 async-trait = "0.1"
-bytes = "1"
+bytes = { workspace = true }
 drain = "0.1"
 futures = { version = "0.3", default-features = false }
-h2 = "0.3"
+h2 = { workspace = true }
 http = { workspace = true }
 http-body = { workspace = true }
 httparse = "1"
diff --git a/linkerd/proxy/identity-client/Cargo.toml b/linkerd/proxy/identity-client/Cargo.toml
index b2d0ef6c21..e41551ce53 100644
--- a/linkerd/proxy/identity-client/Cargo.toml
+++ b/linkerd/proxy/identity-client/Cargo.toml
@@ -18,6 +18,6 @@ parking_lot = "0.12"
 pin-project = "1"
 thiserror = "2"
 tokio = { version = "1", features = ["time", "sync"] }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tracing = "0.1"
 http-body = { workspace = true }
diff --git a/linkerd/proxy/server-policy/Cargo.toml b/linkerd/proxy/server-policy/Cargo.toml
index d673a3850a..21ee77a70f 100644
--- a/linkerd/proxy/server-policy/Cargo.toml
+++ b/linkerd/proxy/server-policy/Cargo.toml
@@ -14,7 +14,7 @@ test-util = []
 governor = { version = "0.8", default-features = false, features = ["std"] }
 ipnet = "2"
 http = { workspace = true }
-prost-types = { version = "0.12", optional = true }
+prost-types = { workspace = true, optional = true }
 thiserror = "2"
 
 linkerd-http-route = { path = "../../http/route" }
diff --git a/linkerd/proxy/spire-client/Cargo.toml b/linkerd/proxy/spire-client/Cargo.toml
index 61c2e0fe94..9fbfa20e9a 100644
--- a/linkerd/proxy/spire-client/Cargo.toml
+++ b/linkerd/proxy/spire-client/Cargo.toml
@@ -16,7 +16,7 @@ linkerd-tonic-watch = { path = "../../tonic-watch" }
 linkerd-exp-backoff = { path = "../../exp-backoff" }
 linkerd-stack = { path = "../../stack" }
 tokio = { version = "1", features = ["time", "sync"] }
-tonic = "0.10"
+tonic = { workspace = true }
 tower = "0.4"
 tracing = "0.1"
 x509-parser = "0.16.0"
diff --git a/linkerd/proxy/tap/Cargo.toml b/linkerd/proxy/tap/Cargo.toml
index 4f2f7823ab..b6d7d9d23f 100644
--- a/linkerd/proxy/tap/Cargo.toml
+++ b/linkerd/proxy/tap/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2021"
 publish = false
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 http = { workspace = true }
 http-body = { workspace = true }
 hyper = { workspace = true, features = ["backports", "deprecated", "http1", "http2"] }
@@ -22,12 +22,12 @@ linkerd-proxy-http = { path = "../http" }
 linkerd-stack = { path = "../../stack" }
 linkerd-tls = { path = "../../tls" }
 parking_lot = "0.12"
-prost-types = "0.12"
+prost-types = { workspace = true }
 rand = { version = "0.8" }
 thiserror = "2"
 tokio = { version = "1", features = ["time"] }
 tower = { version = "0.4", default-features = false }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tracing = "0.1"
 pin-project = "1"
 
diff --git a/linkerd/service-profiles/Cargo.toml b/linkerd/service-profiles/Cargo.toml
index 0b09c22a69..8b0288ea8c 100644
--- a/linkerd/service-profiles/Cargo.toml
+++ b/linkerd/service-profiles/Cargo.toml
@@ -10,17 +10,17 @@ Implements client layers for Linkerd ServiceProfiles.
 """
 
 [dependencies]
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 http = { workspace = true }
 http-body = { workspace = true }
 linkerd2-proxy-api = { workspace = true, features = ["destination"] }
 once_cell = "1.20"
-prost-types = "0.12"
+prost-types = { workspace = true }
 regex = "1"
 tokio = { version = "1", features = ["macros", "rt", "sync", "time"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tower = { version = "0.4.13", features = ["retry", "util"] }
 thiserror = "2"
 tracing = "0.1"
diff --git a/linkerd/tls/Cargo.toml b/linkerd/tls/Cargo.toml
index 7ae3a36946..6ee8a11216 100644
--- a/linkerd/tls/Cargo.toml
+++ b/linkerd/tls/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 async-trait = "0.1"
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 linkerd-conditional = { path = "../conditional" }
 linkerd-dns-name = { path = "../dns/name" }
diff --git a/linkerd/tonic-stream/Cargo.toml b/linkerd/tonic-stream/Cargo.toml
index 1a0ffc7655..873e212b8c 100644
--- a/linkerd/tonic-stream/Cargo.toml
+++ b/linkerd/tonic-stream/Cargo.toml
@@ -10,7 +10,7 @@ publish = false
 futures = { version = "0.3", default-features = false }
 linkerd-stack = { path = "../stack" }
 pin-project = "1"
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tokio = { version = "1", features = ["time"] }
 tracing = "0.1"
 
diff --git a/linkerd/tonic-watch/Cargo.toml b/linkerd/tonic-watch/Cargo.toml
index 1f3ecfe527..f7f3ab2a7b 100644
--- a/linkerd/tonic-watch/Cargo.toml
+++ b/linkerd/tonic-watch/Cargo.toml
@@ -13,7 +13,7 @@ Provides a utility for creating robust watches from a service that returns a str
 futures = { version = "0.3", default-features = false }
 linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
-tonic = { version = "0.10", default-features = false }
+tonic = { workspace = true, default-features = false }
 tokio = { version = "1", features = ["macros", "rt", "sync", "time"] }
 tracing = "0.1"
 
diff --git a/linkerd/trace-context/Cargo.toml b/linkerd/trace-context/Cargo.toml
index 92a42887b3..06b6ebbc62 100644
--- a/linkerd/trace-context/Cargo.toml
+++ b/linkerd/trace-context/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 base64 = "0.13"
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 hex = "0.4"
 http = { workspace = true }
diff --git a/linkerd/transport-header/Cargo.toml b/linkerd/transport-header/Cargo.toml
index 3f5d45384f..e9a1209867 100644
--- a/linkerd/transport-header/Cargo.toml
+++ b/linkerd/transport-header/Cargo.toml
@@ -8,13 +8,13 @@ publish = false
 
 [dependencies]
 async-trait = "0.1"
-bytes = "1"
+bytes = { workspace = true }
 futures = { version = "0.3", default-features = false }
 linkerd-dns-name = { path = "../dns/name" }
 linkerd-error = { path = "../error" }
 linkerd-io = { path = "../io" }
 linkerd-stack = { path = "../stack" }
-prost = "0.12"
+prost = { workspace = true }
 tokio = { version = "1", features = ["time"] }
 tracing = "0.1"
 
diff --git a/opencensus-proto/Cargo.toml b/opencensus-proto/Cargo.toml
index c339c66335..6813e2b7e2 100644
--- a/opencensus-proto/Cargo.toml
+++ b/opencensus-proto/Cargo.toml
@@ -12,17 +12,17 @@ Vendored from https://github.com/census-instrumentation/opencensus-proto/.
 """
 
 [dependencies]
-bytes = "1"
-prost = "0.12"
-prost-types = "0.12"
+bytes = { workspace = true }
+prost = { workspace = true }
+prost-types = { workspace = true }
 
 [dependencies.tonic]
-version = "0.10"
+workspace = true
 default-features = false
 features = ["prost", "codegen"]
 
 [dev-dependencies.tonic-build]
-version = "0.10"
+workspace = true
 default-features = false
 features = ["prost"]
 
diff --git a/opentelemetry-proto/Cargo.toml b/opentelemetry-proto/Cargo.toml
index 94009ad322..76729cfe81 100644
--- a/opentelemetry-proto/Cargo.toml
+++ b/opentelemetry-proto/Cargo.toml
@@ -12,14 +12,14 @@ Vendored from https://github.com/open-telemetry/opentelemetry-rust/.
 """
 
 [dependencies]
-tonic = { version = "0.10", features = ["codegen", "prost", "transport"] }
-prost = "0.12"
+tonic = { workspace = true, features = ["codegen", "prost", "transport"] }
+prost = { workspace = true }
 opentelemetry = { version = "0.27", default-features = false, features = ["trace"] }
 opentelemetry_sdk = { version = "0.27", default-features = false, features = ["trace"] }
 
 [dev-dependencies]
 opentelemetry = { version = "0.27", default-features = false, features = ["trace", "testing"] }
-tonic-build = { version = "0.10", default-features = false, features = ["prost"] }
+tonic-build = { workspace = true, default-features = false, features = ["prost"] }
 
 [lib]
 doctest = false
diff --git a/spiffe-proto/Cargo.toml b/spiffe-proto/Cargo.toml
index 9e1790e63c..a2e5cd1041 100644
--- a/spiffe-proto/Cargo.toml
+++ b/spiffe-proto/Cargo.toml
@@ -7,17 +7,17 @@ edition = "2021"
 publish = false
 
 [dependencies]
-bytes = "1"
-prost = "0.12"
-prost-types = "0.12"
+bytes = { workspace = true }
+prost = { workspace = true }
+prost-types = { workspace = true }
 
 [dependencies.tonic]
-version = "0.10"
+workspace = true
 default-features = false
 features = ["prost", "codegen"]
 
 [dev-dependencies.tonic-build]
-version = "0.10"
+workspace = true
 default-features = false
 features = ["prost"]
 
diff --git a/tools/Cargo.toml b/tools/Cargo.toml
index e32cb390ca..7fc2d22e7b 100644
--- a/tools/Cargo.toml
+++ b/tools/Cargo.toml
@@ -6,6 +6,6 @@ license = "Apache-2.0"
 publish = false
 
 [dependencies.tonic-build]
-version = "0.10"
+workspace = true
 default-features = false
 features = ["prost"]