diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3856d19..583199a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,8 +38,6 @@ jobs:
           deno-version: "2.9.5"
 
       - name: Install dependencies
-        # Before the cargo cache step: the cache keys on the workspaces'
-        # lockfiles, and the .deps/iroh checkout must exist to be keyed.
         run: ./scripts/setup.sh
         # cargo-binstall resolves releases through api.github.com;
         # unauthenticated requests share a 60/hour per-IP limit that pooled
@@ -49,11 +47,11 @@ jobs:
 
       - name: Date sources by their last commit
         # Cargo decides a path dependency is stale when its sources are
-        # newer than its artifact, and a checkout (ours) or a clone
-        # (setup.sh's) stamps every file with the current time — so
-        # restored artifacts always lose to freshly written sources, and
-        # every in-repo crate recompiles however good the cache is.
-        run: ./scripts/restore-mtimes.py . .deps/*
+        # newer than its artifact, and a checkout stamps every file with
+        # the current time — so restored artifacts always lose to
+        # freshly written sources, and every in-repo crate recompiles
+        # however good the cache is.
+        run: ./scripts/restore-mtimes.py .
 
       - name: Cache the cargo home
         uses: Swatinem/rust-cache@v2
@@ -62,11 +60,11 @@ jobs:
           # The build directories are cached below instead. This action
           # saves them only after deleting every package that lives in the
           # repository — which is every crate the gate spends its time on,
-          # ours and the pinned checkouts' — and even for the packages it
-          # keeps it drops artifacts whose file name does not end in a
-          # build hash (cargo emits some, e.g. deps/libiroh_relay.rlib).
-          # A missing output makes cargo rebuild the unit and everything
-          # above it, so what survived rebuilt anyway.
+          # ours — and even for the packages it keeps it drops artifacts
+          # whose file name does not end in a build hash (cargo emits
+          # some, e.g. deps/libiroh_relay.rlib). A missing output makes
+          # cargo rebuild the unit and everything above it, so what
+          # survived rebuilt anyway.
           cache-targets: false
           # The action keys on workspace-MEMBER manifests and lockfiles;
           # the virtual workspace ROOT manifests are never read. But the
@@ -77,17 +75,15 @@ jobs:
           # "up-to-date", discarding everything the change forced it to
           # build, on every run (how #63's target/host tree recompiled
           # cold each time). Hash the roots into the key ourselves.
-          key: gate-inputs-${{ hashFiles('Cargo.toml', '.deps/iroh/Cargo.toml', 'justfile', '.github/justfile', '.github/workflows/ci.yml') }}
+          key: gate-inputs-${{ hashFiles('Cargo.toml', 'justfile', '.github/justfile', '.github/workflows/ci.yml') }}
           # setup.sh has already installed the pinned tools into
           # ~/.cargo/bin when this restore runs; a cached bin/ would roll
           # them back to whatever versions main's cache holds. Excluding
           # bin/ also changes the cache path set, so entries saved with
           # bin/ included no longer match.
           cache-bin: false
-          # The upstream iroh-relay builds into its own checkout's target.
           workspaces: |
             . -> target
-            .deps/iroh -> target
           # Save only on main: PR jobs restore but never save, so PR
           # branches don't churn the cache entries every run depends on.
           save-if: ${{ github.ref == 'refs/heads/main' }}
@@ -98,14 +94,13 @@ jobs:
         with:
           path: |
             target
-            .deps/iroh/target
           # Everything that invalidates artifacts wholesale is in the key:
           # the toolchain, the profiles, the resolved dependency versions,
           # the gate's cargo invocations, and the mtime policy the restored
           # artifacts were judged fresh against. A key that misses still
           # restores the newest entry under the prefix, so cargo rebuilds
           # what changed instead of everything.
-          key: build-dirs-${{ hashFiles('rust-toolchain.toml', 'Cargo.toml', 'Cargo.lock', '.deps/iroh/Cargo.toml', '.deps/iroh/Cargo.lock', 'justfile', '.github/justfile', '.github/workflows/ci.yml', 'scripts/restore-mtimes.py') }}
+          key: build-dirs-${{ hashFiles('rust-toolchain.toml', 'Cargo.toml', 'Cargo.lock', 'justfile', '.github/justfile', '.github/workflows/ci.yml', 'scripts/restore-mtimes.py') }}
           restore-keys: build-dirs-
 
       - name: Run the gate
@@ -120,5 +115,4 @@ jobs:
         with:
           path: |
             target
-            .deps/iroh/target
           key: ${{ steps.build-dirs.outputs.cache-primary-key }}
diff --git a/.github/workflows/jsr-publish.yml b/.github/workflows/jsr-publish.yml
index 575a351..d3d2804 100644
--- a/.github/workflows/jsr-publish.yml
+++ b/.github/workflows/jsr-publish.yml
@@ -1,7 +1,6 @@
 # Publish @polymorph/iroh (host-deltic) to JSR: build the endpoint
-# component from this tree (against the .deps sibling checkouts
-# scripts/setup.sh pins), embed it as the package's base64 asset module,
-# and publish.
+# component from this tree, embed it as the package's base64 asset
+# module, and publish.
 #
 # Auth is GitHub Actions OIDC: the package's GitHub-repository link on
 # jsr.io authorizes runs from this repository — no tokens. Dispatch after
@@ -26,10 +25,6 @@ jobs:
       - uses: denoland/setup-deno@v2
         with:
           deno-version: "2.9.5"
-      - name: Install dependencies (.deps sibling checkouts)
-        run: ./scripts/setup.sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
       - name: Build and embed the endpoint component
         run: |
           cargo build -p iroh-endpoint --target wasm32-wasip2 --release
diff --git a/.gitignore b/.gitignore
index 81ff505..46d63b7 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,4 @@
 target/
-/.deps
 node_modules
 /experiments/iroh-relay-ws/host/dist
 /experiments/iroh-blobs/host/dist
diff --git a/Cargo.lock b/Cargo.lock
index d95a312..5bef178 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2481,6 +2481,8 @@ dependencies = [
 [[package]]
 name = "iroh"
 version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "460de6bc52163b41b1646931f2897e5ab986f0966ade444467fec25024751a72"
 dependencies = [
  "backon",
  "blake3",
@@ -2530,6 +2532,8 @@ dependencies = [
 [[package]]
 name = "iroh-base"
 version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6be73e16ee21c923aca9b3121aaa0db936f7c7ecc156ff47b8dac944c68d59a8"
 dependencies = [
  "curve25519-dalek 5.0.0",
  "data-encoding",
@@ -2547,6 +2551,8 @@ dependencies = [
 [[package]]
 name = "iroh-dns"
 version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46f6a9b39d18e6345f5c151afd299f2488e2cb5c520fe41b107b6bd3dc4c3349"
 dependencies = [
  "arc-swap",
  "cfg_aliases",
@@ -2675,6 +2681,8 @@ dependencies = [
 [[package]]
 name = "iroh-relay"
 version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24bd586cf927f7b700f56ec3639b53cb5fa901ce284784051ff71092bfbf8193"
 dependencies = [
  "blake3",
  "bytes",
@@ -3871,6 +3879,7 @@ dependencies = [
 [[package]]
 name = "polymorph-tls"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-tls.git?rev=e6f244c2136a1fdc8bd836aab05572620c3d3df4#e6f244c2136a1fdc8bd836aab05572620c3d3df4"
 dependencies = [
  "polymorph-tls-profile",
  "rustls",
@@ -3881,6 +3890,7 @@ dependencies = [
 [[package]]
 name = "polymorph-tls-profile"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-tls.git?rev=e6f244c2136a1fdc8bd836aab05572620c3d3df4#e6f244c2136a1fdc8bd836aab05572620c3d3df4"
 dependencies = [
  "ed25519-dalek 3.0.0",
  "rustls",
@@ -3890,6 +3900,7 @@ dependencies = [
 [[package]]
 name = "polymorph-tls-quic"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-tls.git?rev=e6f244c2136a1fdc8bd836aab05572620c3d3df4#e6f244c2136a1fdc8bd836aab05572620c3d3df4"
 dependencies = [
  "aead 0.6.1",
  "aes 0.9.2",
@@ -3913,6 +3924,7 @@ dependencies = [
 [[package]]
 name = "polymorph-webcrypto-core"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-webcrypto.git?rev=227d075a9f306764029dd6762fdab73c6cfc893f#227d075a9f306764029dd6762fdab73c6cfc893f"
 dependencies = [
  "aes 0.8.4",
  "aes-gcm 0.10.3",
@@ -3944,6 +3956,7 @@ dependencies = [
 [[package]]
 name = "polymorph-webcrypto-guest"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-webcrypto.git?rev=227d075a9f306764029dd6762fdab73c6cfc893f#227d075a9f306764029dd6762fdab73c6cfc893f"
 dependencies = [
  "futures",
  "wit-bindgen 0.59.0",
@@ -3952,6 +3965,7 @@ dependencies = [
 [[package]]
 name = "polymorph-webcrypto-wasmtime"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-webcrypto.git?rev=227d075a9f306764029dd6762fdab73c6cfc893f#227d075a9f306764029dd6762fdab73c6cfc893f"
 dependencies = [
  "futures",
  "mea",
@@ -6545,6 +6559,7 @@ dependencies = [
 [[package]]
 name = "wasmtime-webrtc-datachannels"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-webrtc-datachannels.git?rev=0f991407c2698577df3d117789024c14be250bd6#0f991407c2698577df3d117789024c14be250bd6"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -6558,6 +6573,7 @@ dependencies = [
 [[package]]
 name = "wasmtime-websocket"
 version = "0.1.0"
+source = "git+https://github.com/polymorph-components/polymorph-websocket.git?rev=7c364c593d51a977f5f267711b06d0fb18cfc068#7c364c593d51a977f5f267711b06d0fb18cfc068"
 dependencies = [
  "futures",
  "rustls",
diff --git a/Cargo.toml b/Cargo.toml
index 3c93cec..da60957 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,27 +5,32 @@ members = ["core", "endpoint", "endpoint-demo", "host-wasmtime", "experiments/ex
 # set. The wasm-only components build for their target through the
 # justfile recipes.
 default-members = ["core", "host-wasmtime"]
-# The sibling checkouts under .deps are their own workspaces; without the
-# exclusion cargo binds their workspace-inheriting members to this root.
-# experiments/udp-wake is likewise its own workspace: it needs no sibling
-# checkouts and builds with its own RUSTFLAGS (`--cfg tokio_unstable`).
-exclude = [".deps", "experiments/udp-wake"]
+# experiments/udp-wake is its own workspace: it builds with its own
+# RUSTFLAGS (`--cfg tokio_unstable`).
+exclude = ["experiments/udp-wake"]
 
 [workspace.package]
 edition = "2021"
 publish = false
 
-# Sibling host/guest crates come from git worktrees under .deps (created by
-# scripts/setup.sh at pinned commits), so this repository consumes the
-# siblings' current mainline surfaces without forking them in-tree.
+# Sibling crates are consumed as git dependencies pinned at a commit, per
+# the siblings' own release practice; bumped deliberately.
+[workspace.dependencies]
+polymorph-tls-profile = { git = "https://github.com/polymorph-components/polymorph-tls.git", rev = "e6f244c2136a1fdc8bd836aab05572620c3d3df4" }
+polymorph-tls-quic = { git = "https://github.com/polymorph-components/polymorph-tls.git", rev = "e6f244c2136a1fdc8bd836aab05572620c3d3df4" }
+polymorph-webcrypto-guest = { git = "https://github.com/polymorph-components/polymorph-webcrypto.git", rev = "227d075a9f306764029dd6762fdab73c6cfc893f" }
+polymorph-webcrypto-wasmtime = { git = "https://github.com/polymorph-components/polymorph-webcrypto.git", rev = "227d075a9f306764029dd6762fdab73c6cfc893f" }
+wasmtime-webrtc-datachannels = { git = "https://github.com/polymorph-components/polymorph-webrtc-datachannels.git", rev = "0f991407c2698577df3d117789024c14be250bd6" }
+wasmtime-websocket = { git = "https://github.com/polymorph-components/polymorph-websocket.git", rev = "7c364c593d51a977f5f267711b06d0fb18cfc068" }
+
 [profile.release]
 lto = true
 opt-level = "s"
 
 # The native host binaries (test harnesses, not shipped artifacts).
 # Fat LTO buys real size on the guest components but only link time
-# here — and CI relinks the hosts every run, since freshly checked-out
-# path deps are always mtime-dirty. Thin LTO parallelizes the links.
+# here, and the hosts relink on every gate run that touches anything
+# beneath them. Thin LTO parallelizes the links.
 [profile.host]
 inherits = "release"
 lto = "thin"
diff --git a/README.md b/README.md
index 57d293c..a0d0e98 100644
--- a/README.md
+++ b/README.md
@@ -216,10 +216,9 @@ hand the server's printed endpoint ID to the client
 wire):
 
 ```sh
-./scripts/setup.sh   # sibling + iroh checkouts under .deps, npm installs
+./scripts/setup.sh   # pinned tools + the iroh-relay binary, npm installs
 just build           # components + host binaries
-just relay-build
-.deps/iroh/target/release/iroh-relay --dev &   # ws on 127.0.0.1:3340
+iroh-relay --dev &   # ws on 127.0.0.1:3340
 WEBRTC_INCLUDE_LOOPBACK=1 target/host/endpoint-demo \
   target/components/iroh-demo.wasm \
   --role server --relay http://127.0.0.1:3340 --webrtc &
diff --git a/core/Cargo.toml b/core/Cargo.toml
index d42a2ea..1692ad2 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -8,8 +8,8 @@ description = "Shared endpoint core: the webcrypto-held identity, RPK TLS config
 [dependencies]
 # The TLS 1.3 crypto core: the polymorph:tls sibling's wasm-safe profile with
 # QUIC packet protection and quinn session glue, all in-guest RustCrypto.
-polymorph-tls-profile = { path = "../.deps/tls/rust/profile" }
-polymorph-tls-quic = { path = "../.deps/tls/rust/quic" }
+polymorph-tls-profile.workspace = true
+polymorph-tls-quic.workspace = true
 rustls = { version = "=0.23.43", default-features = false, features = ["std", "custom-provider"] }
 rustls-pki-types = "1"
 hex = "0.4"
@@ -21,6 +21,6 @@ serde = { version = "1", default-features = false, features = ["derive"] }
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 blake3 = { version = "1", default-features = false }
 wit-bindgen = { version = "0.59", features = ["async"] }
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
 
 [dev-dependencies]
diff --git a/endpoint-demo/Cargo.toml b/endpoint-demo/Cargo.toml
index 437f9d1..2181c38 100644
--- a/endpoint-demo/Cargo.toml
+++ b/endpoint-demo/Cargo.toml
@@ -12,4 +12,4 @@ crate-type = ["cdylib"]
 wit-bindgen = { version = "0.59", features = ["async"] }
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
 hex = "0.4"
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
diff --git a/endpoint/Cargo.toml b/endpoint/Cargo.toml
index e7036ab..be41d66 100644
--- a/endpoint/Cargo.toml
+++ b/endpoint/Cargo.toml
@@ -10,7 +10,7 @@ crate-type = ["cdylib"]
 
 [dependencies]
 iroh-endpoint-core = { path = "../core" }
-polymorph-tls-quic = { path = "../.deps/tls/rust/quic" }
+polymorph-tls-quic.workspace = true
 noq-proto = { version = "=1.1.0", default-features = false }
 rustls = { version = "=0.23.43", default-features = false, features = ["std", "custom-provider"] }
 getrandom = "0.4"
@@ -20,4 +20,4 @@ wit-bindgen = { version = "0.59", features = ["async", "async-spawn", "inter-tas
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-polymorph-webcrypto-guest = { path = "../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
diff --git a/experiments/exec-model/guest/Cargo.toml b/experiments/exec-model/guest/Cargo.toml
index 348fa41..418955e 100644
--- a/experiments/exec-model/guest/Cargo.toml
+++ b/experiments/exec-model/guest/Cargo.toml
@@ -11,5 +11,5 @@ crate-type = ["cdylib"]
 [dependencies]
 wit-bindgen = { version = "0.59", features = ["async", "async-spawn"] }
 futures = { version = "0.3", default-features = false, features = ["async-await", "std"] }
-polymorph-webcrypto-guest = { path = "../../../.deps/webcrypto/rust/guest" }
+polymorph-webcrypto-guest.workspace = true
 hex = "0.4"
diff --git a/experiments/iroh-blobs/host/browser-test.mjs b/experiments/iroh-blobs/host/browser-test.mjs
index 11f75fc..57fd12c 100644
--- a/experiments/iroh-blobs/host/browser-test.mjs
+++ b/experiments/iroh-blobs/host/browser-test.mjs
@@ -31,7 +31,7 @@ const GUEST_WASM = join(
   HOST_DIR,
   "../guest/target/wasm32-wasip2/release/iroh-blobs-guest.wasm",
 );
-const RELAY_BIN = join(ROOT, ".deps/iroh/target/release/iroh-relay");
+const RELAY_BIN = "iroh-relay";
 const TIMEOUT_MS = 90_000;
 
 const MIME = {
diff --git a/experiments/iroh-blobs/run.sh b/experiments/iroh-blobs/run.sh
index 802897a..ac16e79 100755
--- a/experiments/iroh-blobs/run.sh
+++ b/experiments/iroh-blobs/run.sh
@@ -1,14 +1,14 @@
 #!/usr/bin/env bash
-# Runs the iroh-blobs spike end to end: a stock iroh-relay server (from
-# .deps/iroh, built by the just recipe), then the deltic host on stock
-# Deno driving the wasip2 guest — runtime-linked, no transpile step; the
-# translator ships inside the pinned @deltic/translator package.
+# Runs the iroh-blobs spike end to end: the pinned iroh-relay binary
+# (scripts/setup.sh), then the deltic host on stock Deno driving the
+# wasip2 guest — runtime-linked, no transpile step; the translator ships
+# in the pinned @deltic/translator package.
 # Reuses an already-running relay on 127.0.0.1:3340; kills only what it
 # started.
 set -euo pipefail
 cd "$(dirname "$0")"
 
-RELAY_BIN=../../.deps/iroh/target/release/iroh-relay
+RELAY_BIN=iroh-relay
 RELAY_PID=""
 
 if ! curl -s -m 2 http://127.0.0.1:3340 >/dev/null 2>&1; then
diff --git a/experiments/iroh-relay-ws/host/browser-test.mjs b/experiments/iroh-relay-ws/host/browser-test.mjs
index fa001fe..51b452c 100644
--- a/experiments/iroh-relay-ws/host/browser-test.mjs
+++ b/experiments/iroh-relay-ws/host/browser-test.mjs
@@ -30,7 +30,7 @@ const GUEST_WASM = join(
   HOST_DIR,
   "../guest/target/wasm32-wasip2/release/iroh-relay-ws-guest.wasm",
 );
-const RELAY_BIN = join(ROOT, ".deps/iroh/target/release/iroh-relay");
+const RELAY_BIN = "iroh-relay";
 const TIMEOUT_MS = 90_000;
 
 const MIME = {
diff --git a/experiments/iroh-relay-ws/run.sh b/experiments/iroh-relay-ws/run.sh
index 3d215e0..d192ec3 100755
--- a/experiments/iroh-relay-ws/run.sh
+++ b/experiments/iroh-relay-ws/run.sh
@@ -1,13 +1,13 @@
 #!/usr/bin/env bash
-# Runs the iroh-relay-ws spike end to end: a stock iroh-relay server (from
-# .deps/iroh, built by the just recipe), then the deltic host on stock
-# Deno driving the wasip2 guest — runtime-linked, no transpile step; the
-# translator ships inside the pinned @deltic/translator package. Reuses an
-# already-running relay on 127.0.0.1:3340; kills only what it started.
+# Runs the iroh-relay-ws spike end to end: the pinned iroh-relay binary
+# (scripts/setup.sh), then the deltic host on stock Deno driving the
+# wasip2 guest — runtime-linked, no transpile step; the translator ships
+# inside the pinned @deltic/translator package. Reuses an already-running
+# relay on 127.0.0.1:3340; kills only what it started.
 set -euo pipefail
 cd "$(dirname "$0")"
 
-RELAY_BIN=../../.deps/iroh/target/release/iroh-relay
+RELAY_BIN=iroh-relay
 RELAY_PID=""
 
 if ! curl -s -m 2 http://127.0.0.1:3340 >/dev/null 2>&1; then
diff --git a/experiments/ping-demo/web/test.mjs b/experiments/ping-demo/web/test.mjs
index 749810c..e4c0b48 100644
--- a/experiments/ping-demo/web/test.mjs
+++ b/experiments/ping-demo/web/test.mjs
@@ -13,7 +13,7 @@ import { fileURLToPath } from "node:url";
 import { chromium } from "playwright";
 
 const SITE = fileURLToPath(new URL("./site", import.meta.url));
-const RELAY_BIN = fileURLToPath(new URL("../../../.deps/iroh/target/release/iroh-relay", import.meta.url));
+const RELAY_BIN = "iroh-relay";
 const RELAY_URL = "http://127.0.0.1:3340";
 const TIMEOUT = 60_000;
 
diff --git a/host-deltic/src/repo.ts b/host-deltic/src/repo.ts
index b11777e..9c739e0 100644
--- a/host-deltic/src/repo.ts
+++ b/host-deltic/src/repo.ts
@@ -1,6 +1,6 @@
 // Repo-internal exam machinery, publish-excluded (deno.json
 // `publish.exclude`): paths into this repository's build outputs and the
-// locally built upstream relay. The published package carries none of
+// pinned upstream relay binary. The published package carries none of
 // this — consumers use the packaged endpoint component (or pass their own
 // bytes) and bring their own relay.
 
@@ -12,9 +12,9 @@ const ROOT = new URL("../../", import.meta.url);
 export const ENDPOINT_WASM =
   new URL("target/wasm32-wasip2/release/iroh_endpoint.wasm", ROOT).pathname;
 
-/** The stock upstream relay, built by `just relay-build`. */
-export const RELAY_BIN =
-  new URL(".deps/iroh/target/release/iroh-relay", ROOT).pathname;
+/** The stock upstream relay binary, pinned and installed onto PATH by
+ * `scripts/setup.sh`. */
+export const RELAY_BIN = "iroh-relay";
 /** `iroh-relay --dev` serves ws on this address. */
 export const RELAY_PORT = 3340;
 export const RELAY_URL = `http://127.0.0.1:${RELAY_PORT}`;
@@ -74,16 +74,21 @@ export async function startRelay(): Promise<Relay> {
     console.error(`relay: adopting an already-listening 127.0.0.1:${RELAY_PORT}`);
     return { url: RELAY_URL, stop: () => Promise.resolve() };
   }
-  if (!await exists(RELAY_BIN)) {
-    throw new Error(
-      `iroh-relay not found at ${RELAY_BIN} — build it with \`just relay-build\`.`,
-    );
+  let child: Deno.ChildProcess;
+  try {
+    child = new Deno.Command(RELAY_BIN, {
+      args: ["--dev"],
+      stdout: "piped",
+      stderr: "piped",
+    }).spawn();
+  } catch (e) {
+    if (e instanceof Deno.errors.NotFound) {
+      throw new Error(
+        `\`${RELAY_BIN}\` not found on PATH — install it with \`scripts/setup.sh\`.`,
+      );
+    }
+    throw e;
   }
-  const child = new Deno.Command(RELAY_BIN, {
-    args: ["--dev"],
-    stdout: "piped",
-    stderr: "piped",
-  }).spawn();
   // Drain the pipes so the relay never blocks on a full stdio buffer, and
   // so `stop()` can close them without an unresolved-read sanitizer hit.
   const sink = (r: ReadableStream<Uint8Array>) =>
diff --git a/host-wasmtime/Cargo.toml b/host-wasmtime/Cargo.toml
index 6494f8d..acae963 100644
--- a/host-wasmtime/Cargo.toml
+++ b/host-wasmtime/Cargo.toml
@@ -9,13 +9,13 @@ description = "Native hosts: run this repository's guest components under Wasmti
 [dependencies]
 # The `polymorph:webrtc-datachannels` host implementation (a real webrtc-rs peer
 # connection behind the `connections` imports).
-wasmtime-webrtc-datachannels = { path = "../.deps/webrtc/wasmtime-impl" }
+wasmtime-webrtc-datachannels.workspace = true
 # The `polymorph:webcrypto` host implementation (RustCrypto behind the crypto
 # imports the guest's TLS layer uses).
-polymorph-webcrypto-wasmtime = { path = "../.deps/webcrypto/rust/wasmtime" }
+polymorph-webcrypto-wasmtime.workspace = true
 # The `polymorph:websocket` host implementation (tokio-tungstenite behind the
 # relay connection the guest signals over).
-wasmtime-websocket = { path = "../.deps/websocket/rust/wasmtime" }
+wasmtime-websocket.workspace = true
 wasmtime = { version = "47", features = ["component-model", "component-model-async", "async", "cranelift", "runtime"] }
 wasmtime-wasi = { version = "47", features = ["p3"] }
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time"] }
diff --git a/justfile b/justfile
index 618e13b..c2306b5 100644
--- a/justfile
+++ b/justfile
@@ -9,7 +9,7 @@ mod gha '.github'
 default:
     @just --list
 
-# One-shot dependency setup (sibling + iroh checkouts).
+# One-shot dependency setup (pinned tools + the iroh-relay binary).
 setup:
     ./scripts/setup.sh
 
@@ -35,10 +35,6 @@ build-components:
 build-hosts:
     cargo build -p iroh-host-wasmtime -p iroh-peer --bin endpoint-demo --bin iroh-peer --profile host
 
-# Build the stock upstream relay server (used by the matrix and demos).
-relay-build:
-    cd .deps/iroh && cargo build --release -p iroh-relay --features server --bin iroh-relay
-
 build: build-components build-hosts
 
 # Native tests: the crypto/framing known answers.
@@ -77,7 +73,7 @@ probes: build-components
     target/host/exec-model target/wasm32-wasip2/release/iroh_exec_model_guest.wasm
 
 # The cross-host pairing matrix: every demo pairing asserted in one run.
-matrix: build relay-build
+matrix: build
     ./scripts/matrix.sh
 
 # The deltic host's module graph + the node-datachannel addon (whose
@@ -89,7 +85,7 @@ deltic-setup:
 # runtime-linked under stock Deno — bind + identity, relay echo, WebRTC
 # upgrade, the issue #10 concurrency rows, teardown. See
 # host-deltic/README.md.
-exam-deltic: build-components relay-build deltic-setup
+exam-deltic: build-components deltic-setup
     #!/usr/bin/env bash
     set -euo pipefail
     # One RESOLVED deltic version repo-wide (host-deltic/README.md "The
@@ -110,7 +106,7 @@ exam-deltic: build-components relay-build deltic-setup
         exit 1
     fi
     # ...and the RESOLVED graph must agree: one embedder instance, no raw
-    # URLs (a sibling .deps module's own config can silently split module
+    # URLs (a sibling module's own config can silently split module
     # identity in a way no config grep catches; see the gate script).
     deno info --json --config host-deltic/deno.json host-deltic/src/run-endpoint.ts \
         | deno run scripts/deltic-identity-gate.ts
@@ -119,7 +115,7 @@ exam-deltic: build-components relay-build deltic-setup
 
 # The measured-claims gate: per-wire latency/throughput medians,
 # asserted against budgets (issue #4).
-bench: build relay-build
+bench: build
     ./scripts/bench.sh
 
 # The endpoint against n0's production relays over wss (issue #2).
@@ -134,8 +130,9 @@ interop-prod: build
 # bootstrap over the polymorph-websocket sibling's deltic module, then
 # live migration onto a WebRTC data channel through the synthetic-address
 # overlay (issue #26). Research probe attached to the issue, so manual:
-# not part of `ci`. Needs the sibling checkouts from setup.sh.
-iroh-relay-ws: relay-build
+# not part of `ci`. The host's sibling deltic module imports await the
+# JSR migration (issue #83).
+iroh-relay-ws:
     cd experiments/iroh-relay-ws/guest && cargo build --release
     cd experiments/iroh-relay-ws/host && deno install --frozen --allow-scripts=npm:node-datachannel
     ./experiments/iroh-relay-ws/run.sh
diff --git a/scripts/bench.sh b/scripts/bench.sh
index 8932d93..151e621 100755
--- a/scripts/bench.sh
+++ b/scripts/bench.sh
@@ -4,7 +4,7 @@
 # numbers land in target/bench/report.tsv (and stdout); the budgets are
 # the recorded invariants — a number that matters is asserted here, not
 # written in prose. Requires the same artifacts as the matrix
-# (`just build`, `just relay-build`).
+# (`just build`, the pinned iroh-relay binary on PATH).
 set -u
 cd "$(dirname "$0")/.."
 
@@ -41,7 +41,7 @@ cat > "$LOGDIR/relay.toml" <<EOF
 http_bind_addr = "127.0.0.1:${RELAY_PORT}"
 enable_metrics = false
 EOF
-.deps/iroh/target/release/iroh-relay --dev -c "$LOGDIR/relay.toml" \
+iroh-relay --dev -c "$LOGDIR/relay.toml" \
     > "$LOGDIR/relay.log" 2>&1 &
 RELAY_PID=$!
 trap 'kill $RELAY_PID 2>/dev/null' EXIT
diff --git a/scripts/deltic-identity-gate.ts b/scripts/deltic-identity-gate.ts
index 2b8763d..0ac7d9b 100644
--- a/scripts/deltic-identity-gate.ts
+++ b/scripts/deltic-identity-gate.ts
@@ -2,8 +2,8 @@
 // identity"): the run-endpoint graph must contain exactly ONE
 // @deltic/runtime version and ZERO raw.githubusercontent modules.
 //
-// The failure this guards (seen live before the .deps pins converged on
-// JSR-consuming sibling revisions): a sibling host module's own
+// The failure this guards (seen live before the sibling pins converged on
+// one deltic release): a sibling host module's own
 // package-shaped deno.json mapped @deltic/runtime/embedder to a raw
 // pinned-tag URL, so the graph carried TWO embedder module instances and
 // `instanceof ComponentException` silently stopped holding across that sibling's
diff --git a/scripts/matrix.sh b/scripts/matrix.sh
index cac6f7a..6e09de4 100755
--- a/scripts/matrix.sh
+++ b/scripts/matrix.sh
@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 # The repeatable cross-host gate: every demo pairing this repository
 # claims works, asserted in one run. Requires the components and hosts
-# already built (`just build`) and the iroh-relay binary present
-# (`just relay-build`). Prints one PASS/FAIL line per pairing and exits
+# already built (`just build`) and the pinned iroh-relay binary on PATH
+# (`scripts/setup.sh`). Prints one PASS/FAIL line per pairing and exits
 # nonzero if any failed.
 set -u
 cd "$(dirname "$0")/.."
@@ -24,14 +24,14 @@ cat > "$LOGDIR/relay.toml" <<EOF
 http_bind_addr = "127.0.0.1:${RELAY_PORT}"
 enable_metrics = false
 EOF
-.deps/iroh/target/release/iroh-relay --dev -c "$LOGDIR/relay.toml" \
+iroh-relay --dev -c "$LOGDIR/relay.toml" \
     > "$LOGDIR/relay.log" 2>&1 &
 RELAY_PID=$!
 cat > "$LOGDIR/relay-b.toml" <<EOF
 http_bind_addr = "127.0.0.1:${RELAY_B_PORT}"
 enable_metrics = false
 EOF
-.deps/iroh/target/release/iroh-relay --dev -c "$LOGDIR/relay-b.toml" \
+iroh-relay --dev -c "$LOGDIR/relay-b.toml" \
     > "$LOGDIR/relay-b.log" 2>&1 &
 RELAY_B_PID=$!
 trap 'kill $RELAY_PID $RELAY_B_PID 2>/dev/null' EXIT
diff --git a/scripts/restore-mtimes.py b/scripts/restore-mtimes.py
index 089947a..4745a06 100755
--- a/scripts/restore-mtimes.py
+++ b/scripts/restore-mtimes.py
@@ -30,8 +30,8 @@
 
 
 def git(repo, *args):
-    # stderr is inherited: git's own message is the useful one when a path
-    # under .deps is not a checkout.
+    # stderr is inherited: git's own message is the useful one when the
+    # path is not a git checkout.
     return subprocess.run(
         ["git", "-C", repo, "-c", "core.quotePath=false", *args],
         check=True,
diff --git a/scripts/setup.sh b/scripts/setup.sh
index c4e6aed..819720e 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -1,30 +1,20 @@
 #!/usr/bin/env bash
 # One-shot dependency setup, the single source of truth shared by local
-# developers and CI: the pinned toolchain and tools, and sibling
-# repositories checked out under .deps/ at pinned commits. Idempotent;
-# safe to re-run.
+# developers and CI: the pinned toolchain, tools, and the pinned
+# iroh-relay binary. Idempotent; safe to re-run.
 #
 # Environment:
 #   WASM_TOOLS_VERSION   version of wasm-tools to install (default below)
 #   JUST_VERSION         version of just to install (default below)
 #   WAC_VERSION          version of wac-cli to install (default below)
+#   IROH_RELAY_VERSION   version of the iroh-relay binary to install (default below)
 set -euo pipefail
 cd "$(dirname "$0")/.."
 
 WASM_TOOLS_VERSION="${WASM_TOOLS_VERSION:-1.247.0}"
 JUST_VERSION="${JUST_VERSION:-1.54.0}"
 WAC_VERSION="${WAC_VERSION:-0.10.1}"
-
-WEBRTC_REPO=https://github.com/polymorph-components/polymorph-webrtc-datachannels.git
-WEBRTC_PIN=0f991407c2698577df3d117789024c14be250bd6
-WEBCRYPTO_REPO=https://github.com/polymorph-components/polymorph-webcrypto.git
-WEBCRYPTO_PIN=227d075a9f306764029dd6762fdab73c6cfc893f
-WEBSOCKET_REPO=https://github.com/polymorph-components/polymorph-websocket.git
-WEBSOCKET_PIN=7c364c593d51a977f5f267711b06d0fb18cfc068
-IROH_REPO=https://github.com/n0-computer/iroh.git
-IROH_PIN=816dd70c056b813dcb5cbfb6a9a15e12d04b72b1 # v1.0.3
-TLS_REPO=https://github.com/polymorph-components/polymorph-tls.git
-TLS_PIN=e6f244c2136a1fdc8bd836aab05572620c3d3df4
+IROH_RELAY_VERSION="${IROH_RELAY_VERSION:-1.0.3}"
 
 log() { printf '\n==> %s\n' "$1"; }
 
@@ -139,27 +129,21 @@ else
     binstall "wac-cli@${WAC_VERSION}"
 fi
 
-# Check out `repo` at `pin` under .deps/`name`, cloning or fetching as
-# needed. An existing checkout at the pin is left untouched.
-dep() {
-    local name=$1 repo=$2 pin=$3
-    local dir=.deps/$name
-    if [ ! -e "$dir" ]; then
-        git clone "$repo" "$dir"
-    fi
-    if [ "$(git -C "$dir" rev-parse HEAD)" != "$pin" ]; then
-        git -C "$dir" fetch origin "$pin" 2>/dev/null || git -C "$dir" fetch origin
-        git -C "$dir" checkout "$pin"
-    fi
-}
-
-log "Checking out pinned sibling and upstream repositories under .deps/"
-mkdir -p .deps
-dep webrtc "$WEBRTC_REPO" "$WEBRTC_PIN"
-dep webcrypto "$WEBCRYPTO_REPO" "$WEBCRYPTO_PIN"
-dep websocket "$WEBSOCKET_REPO" "$WEBSOCKET_PIN"
-# Upstream iroh: the stock relay server the demo runs against.
-dep iroh "$IROH_REPO" "$IROH_PIN"
-dep tls "$TLS_REPO" "$TLS_PIN"
+log "Ensuring iroh-relay ${IROH_RELAY_VERSION} is installed"
+# Version-checked, not presence-checked: the interop gates pair this
+# binary with the `iroh` crate tools/iroh-peer pins (`=1.0.3`); the two
+# move together. On platforms with no prebuilt release asset, binstall's
+# source fallback needs `--features server` to produce the binary:
+#   cargo install iroh-relay@<ver> --locked --features server
+if command -v iroh-relay >/dev/null 2>&1 && iroh-relay --version 2>/dev/null | grep -qF "${IROH_RELAY_VERSION}"; then
+    echo "iroh-relay already present: $(iroh-relay --version)"
+else
+    binstall "iroh-relay@${IROH_RELAY_VERSION}"
+    hash -r
+    iroh-relay --version 2>/dev/null | grep -qF "${IROH_RELAY_VERSION}" || {
+        echo "setup: a different iroh-relay still shadows ${IROH_RELAY_VERSION} on PATH: $(command -v iroh-relay) ($(iroh-relay --version))" >&2
+        exit 1
+    }
+fi
 
 log "setup complete"
diff --git a/tools/iroh-peer/Cargo.toml b/tools/iroh-peer/Cargo.toml
index 8ad945a..8c1ad6d 100644
--- a/tools/iroh-peer/Cargo.toml
+++ b/tools/iroh-peer/Cargo.toml
@@ -5,10 +5,10 @@ edition.workspace = true
 publish.workspace = true
 
 [dependencies]
-# The upstream implementation under test, from the pinned checkout.
-# Its workspace-inherited deps resolve against .deps/iroh's own root
-# (.deps is excluded from this workspace).
-iroh = { path = "../../.deps/iroh/iroh" }
+# The upstream implementation under test. The pin is co-pinned with the
+# `iroh-relay` binary scripts/setup.sh installs — the two must move
+# together.
+iroh = "=1.0.3"
 
 bytes = "1"
 anyhow = "1"