diff --git a/package.json b/package.json
index 5d036d324..ed921cd33 100644
--- a/package.json
+++ b/package.json
@@ -268,7 +268,6 @@
   "dependencies": {
     "@limrun/api": "^0.24.5",
     "ipaddr.js": "^2.5.0",
-    "tar-stream": "^3.2.0",
     "undici": "7.29.0",
     "yaml": "^2.9.0",
     "yauzl": "^3.4.0"
@@ -323,6 +322,7 @@
     "oxlint": "^1.79.0",
     "pngjs": "^7.0.0",
     "publint": "^0.3.24",
+    "tar-stream": "^3.2.0",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vite": "^8.2.1",
diff --git a/packages/host-kit/package.json b/packages/host-kit/package.json
index 466bb556f..dde926ff3 100644
--- a/packages/host-kit/package.json
+++ b/packages/host-kit/package.json
@@ -7,12 +7,12 @@
   "dependencies": {
     "@agent-device/contracts": "workspace:*",
     "@agent-device/kernel": "workspace:*",
-    "tar-stream": "^3.2.0",
     "yauzl": "^3.4.0"
   },
   "devDependencies": {
     "@types/tar-stream": "^3.1.4",
-    "@types/yauzl": "^3.4.0"
+    "@types/yauzl": "^3.4.0",
+    "tar-stream": "^3.2.0"
   },
   "exports": {
     "./archive": {
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2a1365422..d304bd3ed 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,9 +23,6 @@ importers:
       ipaddr.js:
         specifier: ^2.5.0
         version: 2.5.0
-      tar-stream:
-        specifier: ^3.2.0
-        version: 3.2.0
       undici:
         specifier: ^7.29.0
         version: 7.29.0
@@ -159,6 +156,9 @@ importers:
       publint:
         specifier: ^0.3.24
         version: 0.3.24
+      tar-stream:
+        specifier: ^3.2.0
+        version: 3.2.0
       tsdown:
         specifier: ^0.22.14
         version: 0.22.14(@arethetypeswrong/core@0.18.5)(publint@0.3.24)(typescript@7.0.2)
@@ -236,9 +236,6 @@ importers:
       '@agent-device/kernel':
         specifier: workspace:*
         version: link:../kernel
-      tar-stream:
-        specifier: ^3.2.0
-        version: 3.2.0
       yauzl:
         specifier: ^3.4.0
         version: 3.4.0
@@ -249,6 +246,9 @@ importers:
       '@types/yauzl':
         specifier: ^3.4.0
         version: 3.4.0
+      tar-stream:
+        specifier: ^3.2.0
+        version: 3.2.0
 
   packages/kernel: {}
 
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 4230f51f9..6a500d8a3 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -76,8 +76,16 @@ export default defineConfig({
     'internal/update-check-entry': 'src/cli/update-check-entry.ts',
   },
   deps: {
-    alwaysBundle: [/^@agent-device\//, 'pngjs'],
-    onlyBundle: ['pngjs'],
+    alwaysBundle: [/^@agent-device\//],
+    onlyBundle: [
+      'pngjs',
+      'tar-stream',
+      'streamx',
+      'fast-fifo',
+      'b4a',
+      'text-decoder',
+      'events-universal',
+    ],
   },
   inputOptions: {
     // A build with missing workspace links resolves nothing under `alwaysBundle` and emits the