diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea95491..c3dfcd2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,12 @@ jobs:
 
       - name: Tidy (webhook) go.mod (absorb sibling drift)
         working-directory: webhook
-        run: go mod tidy
+        # -e tolerates transitive *test* imports we don't control —
+        # e.g. when `handshake`'s tests import packages that were
+        # moved out of `pilotprotocol` into `common`. webhook's own
+        # build + tests below are the real gate; tidy is just to
+        # absorb declared-direct-dep drift.
+        run: go mod tidy -e
 
       - name: Run tests with coverage
         working-directory: webhook
diff --git a/go.mod b/go.mod
index 359f74a..e93080a 100644
--- a/go.mod
+++ b/go.mod
@@ -2,13 +2,16 @@ module github.com/pilot-protocol/webhook
 
 go 1.25.10
 
-require github.com/pilot-protocol/handshake v0.1.0
+require github.com/pilot-protocol/handshake v0.2.1
 
 require (
-	github.com/TeoSlayer/pilotprotocol v0.0.0 // indirect
-	github.com/pilot-protocol/common v0.2.0
+	github.com/pilot-protocol/rendezvous v0.2.4 // indirect
+	github.com/pilot-protocol/trustedagents v0.2.3 // indirect
+	golang.org/x/sys v0.45.0 // indirect
 )
 
+require github.com/pilot-protocol/common v0.4.8
+
 replace github.com/TeoSlayer/pilotprotocol => ../web4
 
 replace github.com/pilot-protocol/common => ../common
diff --git a/go.sum b/go.sum
index 6a4dd03..9e9265c 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,10 @@
 github.com/coder/websocket v1.8.14 h1:9L0p0iKiNOibykf283eHkKUHHrpG7f65OE3BhhO7v9g=
 github.com/coder/websocket v1.8.14/go.mod h1:NX3SzP+inril6yawo5CQXx8+fk145lPDC6pumgx0mVg=
-github.com/pilot-protocol/handshake v0.1.0 h1:TmqIglsimTynKtE5hLpCt/SZmmBYs8OCn4qn755fmew=
-github.com/pilot-protocol/handshake v0.1.0/go.mod h1:FIIMTgRcMIMEim/1d7F5f6YenJC+3xl53QMEmnnJY+0=
-github.com/pilot-protocol/rendezvous v0.1.0 h1:vOBD7CnRY8uU8vma0Vfcr0aPSQ54qNuxppNUiljzk9Y=
-github.com/pilot-protocol/rendezvous v0.1.0/go.mod h1:g3/IYBykbU5m9jeprSCrmuoDpaqROO4Lu/+ecKVIF3A=
-github.com/pilot-protocol/trustedagents v0.1.0 h1:rCX0IQxfZ84Q4dSgw01WJgjHUODRnI3iAon1t+NuFGE=
-github.com/pilot-protocol/trustedagents v0.1.0/go.mod h1:uVySmuMPb6N7AOCnvLHN2I9C9ggqEpfBmAZwVuP5Xaw=
+github.com/pilot-protocol/handshake v0.2.1 h1:ZPRLKPV5Heigzj4HNkwb/JOiabdVPg3XzH4LocCCCZo=
+github.com/pilot-protocol/handshake v0.2.1/go.mod h1:g88rTfLUY9sxj9j41IqjpuEBZ5Rwe4xsOjh8JmTeGT8=
+github.com/pilot-protocol/rendezvous v0.2.4 h1:nxYm12RzEUA6zzNGcnDqxNcGBSIALL5uRH9zX+Q0CSg=
+github.com/pilot-protocol/rendezvous v0.2.4/go.mod h1:w7SC0nZCmWPyc7hxdFZ200zQVA75UoaC25MznUQXNFE=
+github.com/pilot-protocol/trustedagents v0.2.3 h1:QQJHYqzPrECJwkCev0xIDBMjd92uhtcxcCMc2aOrRHc=
+github.com/pilot-protocol/trustedagents v0.2.3/go.mod h1:gDgEOC9lHmXSS9v45h80XxlmUS861soIrA0AsbXiSV4=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=