diff --git a/.busbar-ref b/.busbar-ref
index 955d648..9e85a74 100644
--- a/.busbar-ref
+++ b/.busbar-ref
@@ -1 +1 @@
-7c6d8b4b4d0e352dc57777c04f49571ec5b5be23 1.6.0
+7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4 1.6.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d3d38bd..954ca68 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ permissions:
 
 jobs:
   ci:
-    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+    uses: GetBusbar/busbar/.github/workflows/plugin-ci.yml@7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
     with:
       service: postgres
       busbar_checkout: true
diff --git a/.github/workflows/consumer-verify.yml b/.github/workflows/consumer-verify.yml
index 3b267c4..1e30cae 100644
--- a/.github/workflows/consumer-verify.yml
+++ b/.github/workflows/consumer-verify.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   consumer:
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
     with:
       version: ${{ inputs.version || '' }}
       asset_prefix: busbar-store-postgres
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 17efee2..e4e1530 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
     secrets: inherit
   release:
     needs: ci
-    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+    uses: GetBusbar/busbar/.github/workflows/plugin-release.yml@7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
     with:
       plugin_crate: busbar-store-postgres-plugin
       manifest_name: busbar-store-postgres
@@ -37,11 +37,12 @@ jobs:
       needs_prompt: ""
       needs_user: ""
       declares_file: "store-postgres/declares.json"
+      former_names: "busbar-store-postgres-plugin"
     secrets: inherit
   consumer-verify:
     needs: release
     if: ${{ !cancelled() }}
-    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+    uses: GetBusbar/busbar/.github/workflows/plugin-consumer-verify.yml@7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
     with:
       version: ${{ github.ref_name }}
       asset_prefix: busbar-store-postgres
diff --git a/.github/workflows/repin.yml b/.github/workflows/repin.yml
index 1c94a08..d196c6f 100644
--- a/.github/workflows/repin.yml
+++ b/.github/workflows/repin.yml
@@ -28,7 +28,7 @@ permissions:
 
 jobs:
   repin:
-    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+    uses: GetBusbar/busbar/.github/workflows/plugin-repin.yml@7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
     with:
       busbar_sha: ${{ github.event.client_payload.sha || inputs.busbar_sha }}
       busbar_version: ${{ github.event.client_payload.version || inputs.busbar_version }}
diff --git a/Cargo.lock b/Cargo.lock
index aec9a7d..ea529fb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -21,15 +21,6 @@ dependencies = [
  "zerocopy",
 ]
 
-[[package]]
-name = "aho-corasick"
-version = "1.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"
-dependencies = [
- "memchr",
-]
-
 [[package]]
 name = "arc-swap"
 version = "1.9.2"
@@ -219,7 +210,7 @@ checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 [[package]]
 name = "busbar-contract"
 version = "1.6.0"
-source = "git+https://www.github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://www.github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "async-trait",
  "base64 0.22.1",
@@ -242,7 +233,7 @@ dependencies = [
 [[package]]
 name = "busbar-core-connector"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "busbar-kernel",
@@ -266,7 +257,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "arc-swap",
  "async-trait",
@@ -296,7 +287,6 @@ dependencies = [
  "hyper-util",
  "indexmap",
  "metrics",
- "metrics-exporter-prometheus",
  "metrics-util",
  "ring",
  "serde",
@@ -308,6 +298,7 @@ dependencies = [
  "tokio-util",
  "tower",
  "tracing",
+ "tracing-log",
  "tracing-subscriber",
  "url",
  "zeroize",
@@ -316,7 +307,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-audit"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "ed25519-dalek",
@@ -327,7 +318,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-breaker"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "httpdate",
@@ -336,7 +327,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-egress"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "bytes",
@@ -346,7 +337,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-identity"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "hex",
@@ -358,7 +349,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-ledger"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "ring",
@@ -368,7 +359,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-scope"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
 ]
@@ -376,7 +367,7 @@ dependencies = [
 [[package]]
 name = "busbar-kernel-wal"
 version = "1.6.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "ring",
@@ -385,7 +376,7 @@ dependencies = [
 [[package]]
 name = "busbar-plugin-loader"
 version = "1.5.0"
-source = "git+https://github.com/GetBusbar/busbar?rev=7c6d8b4b4d0e352dc57777c04f49571ec5b5be23#7c6d8b4b4d0e352dc57777c04f49571ec5b5be23"
+source = "git+https://github.com/GetBusbar/busbar?rev=7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4#7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4"
 dependencies = [
  "busbar-contract",
  "busbar-kernel-ledger",
@@ -730,17 +721,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "evmap"
-version = "11.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b8874945f036109c72242964c1174cf99434e30cfa45bf45fedc983f50046f8"
-dependencies = [
- "hashbag",
- "left-right",
- "smallvec",
-]
-
 [[package]]
 name = "fallible-iterator"
 version = "0.2.0"
@@ -900,21 +880,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generator"
-version = "0.8.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52f04ae4152da20c76fe800fa48659201d5cf627c5149ca0b707b69d7eef6cf9"
-dependencies = [
- "cc",
- "cfg-if",
- "libc",
- "log",
- "rustversion",
- "windows-link",
- "windows-result",
-]
-
 [[package]]
 name = "generic-array"
 version = "0.14.7"
@@ -983,12 +948,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "hashbag"
-version = "0.1.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7040a10f52cba493ddb09926e15d10a9d8a28043708a405931fe4c6f19fac064"
-
 [[package]]
 name = "hashbrown"
 version = "0.16.1"
@@ -1207,17 +1166,6 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
-[[package]]
-name = "left-right"
-version = "0.11.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0f0c21e4c8ff95f487fb34e6f9182875f42c84cef966d29216bf115d9bba835a"
-dependencies = [
- "crossbeam-utils",
- "loom",
- "slab",
-]
-
 [[package]]
 name = "libc"
 version = "0.2.189"
@@ -1258,34 +1206,12 @@ version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
 
-[[package]]
-name = "loom"
-version = "0.7.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "419e0dc8046cb947daa77eb95ae174acfbddb7673b4151f56d1eed8e93fbfaca"
-dependencies = [
- "cfg-if",
- "generator",
- "scoped-tls",
- "tracing",
- "tracing-subscriber",
-]
-
 [[package]]
 name = "lru-slab"
 version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112b39cec0b298b6c1999fee3e31427f74f676e4cb9879ed1a121b43661a4154"
 
-[[package]]
-name = "matchers"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
-dependencies = [
- "regex-automata",
-]
-
 [[package]]
 name = "matchit"
 version = "0.8.4"
@@ -1318,21 +1244,6 @@ dependencies = [
  "rapidhash",
 ]
 
-[[package]]
-name = "metrics-exporter-prometheus"
-version = "0.18.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1db0d8f1fc9e62caebd0319e11eaec5822b0186c171568f0480b46a0137f9108"
-dependencies = [
- "base64 0.22.1",
- "evmap",
- "indexmap",
- "metrics",
- "metrics-util",
- "quanta",
- "thiserror",
-]
-
 [[package]]
 name = "metrics-util"
 version = "0.20.4"
@@ -1900,23 +1811,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "regex-automata"
-version = "0.4.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
-dependencies = [
- "aho-corasick",
- "memchr",
- "regex-syntax",
-]
-
-[[package]]
-name = "regex-syntax"
-version = "0.8.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
-
 [[package]]
 name = "rend"
 version = "0.5.3"
@@ -2079,12 +1973,6 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
-[[package]]
-name = "scoped-tls"
-version = "1.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1cf6437eb19a8f4a6cc0f7dca544973b0b78843adbfeb3683d1a94a0024a294"
-
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
@@ -2643,14 +2531,10 @@ version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
- "matchers",
  "nu-ansi-term",
- "once_cell",
- "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
- "tracing",
  "tracing-core",
  "tracing-log",
 ]
@@ -2932,15 +2816,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
diff --git a/Cargo.toml b/Cargo.toml
index e0ce20b..78f5a56 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,8 +10,8 @@
 # `.busbar-ref`; no sibling-checkout path dependency ships in any manifest.
 #
 # THIRD-PARTY VERSIONS ARE THE FLEET'S, NOT THIS REPO'S. The table below is busbar's own root
-# `[workspace.dependencies]` (third-party rows) at busbar 7c6d8b4b4d0e352dc57777c04f49571ec5b5be23, followed by the plugin-only rows
-# of busbar's `.github/fleet/deps.toml` at 7c6d8b4b4d0e352dc57777c04f49571ec5b5be23. A member takes a crate with
+# `[workspace.dependencies]` (third-party rows) at busbar 7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4, followed by the plugin-only rows
+# of busbar's `.github/fleet/deps.toml` at 7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4. A member takes a crate with
 # `{ workspace = true }` (adding features if it needs them); a crate in neither table is a new
 # `deps.toml` row in busbar first. CI holds this repo's Cargo.lock to busbar's lock at the pin.
 [workspace]
@@ -29,14 +29,14 @@ publish = false
 repository = "https://github.com/GetBusbar/busbar-store-postgres"
 
 [workspace.dependencies]
-busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "7c6d8b4b4d0e352dc57777c04f49571ec5b5be23" }
-busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "7c6d8b4b4d0e352dc57777c04f49571ec5b5be23" }
+busbar-contract = { git = "https://github.com/GetBusbar/busbar", rev = "7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4" }
+busbar-plugin-loader = { git = "https://github.com/GetBusbar/busbar", rev = "7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4" }
 # THE SUITE'S HOST CONNECTOR (dev-only; store-postgres-plugin/tests/support/conformance_host.rs,
 # rendered because the declares file states network needs): busbar's connector and its TLS
 # test kit at the pin, and the transport framers those needs name, at the revs busbar links.
-busbar-core-connector = { git = "https://github.com/GetBusbar/busbar", rev = "7c6d8b4b4d0e352dc57777c04f49571ec5b5be23", features = ["test-support"] }
+busbar-core-connector = { git = "https://github.com/GetBusbar/busbar", rev = "7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4", features = ["test-support"] }
 busbar-transport-tcp = { git = "https://github.com/GetBusbar/busbar-transport-tcp", rev = "89d08ebcb91e5b2d4001b667fba151d9bc09d22d" }
-# busbar's root [workspace.dependencies], third-party rows, at 7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+# busbar's root [workspace.dependencies], third-party rows, at 7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
 a2a-lf = "0.3.0"
 a2a-pb = "0.2.0"
 arc-swap = "1"
@@ -112,7 +112,7 @@ url = "2"
 webpki = { package = "rustls-webpki", version = "0.103", default-features = false, features = ["std", "ring"] }
 webpki-roots = "1"
 zeroize = "1"
-# busbar .github/fleet/deps.toml [plugin-deps], at 7c6d8b4b4d0e352dc57777c04f49571ec5b5be23
+# busbar .github/fleet/deps.toml [plugin-deps], at 7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4
 ldap3 = { version = "0.12", default-features = false, features = ["sync"] }
 mysql = { version = "28", default-features = false, features = ["minimal-rust"] }
 mysql_common = { version = "0.35", default-features = false }
@@ -127,4 +127,4 @@ ulid = "1"
 # patches them to its own tree. The source is busbar spelled through www.github.com: Cargo
 # refuses a patch that names the source it patches.
 [patch."https://github.com/GetBusbar/busbar"]
-busbar-contract = { git = "https://www.github.com/GetBusbar/busbar", rev = "7c6d8b4b4d0e352dc57777c04f49571ec5b5be23" }
+busbar-contract = { git = "https://www.github.com/GetBusbar/busbar", rev = "7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4" }
diff --git a/deny.toml b/deny.toml
index 54b318d..b8fa416 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,5 +1,5 @@
 # RENDERED by `busbar-release plugin sync` from GetBusbar/busbar-release template/ and busbar's
-# `.github/fleet/deps.toml` at 7c6d8b4b4d0e352dc57777c04f49571ec5b5be23; a hand edit is overwritten by the next sync. CI runs
+# `.github/fleet/deps.toml` at 7356bbfb6baeb0e9245a59dc74f8b4bfadb2c5a4; a hand edit is overwritten by the next sync. CI runs
 # `cargo deny check` on it (busbar's plugin-ci.yml at the pin). The license allowlist is busbar's own;
 # the one reviewed git source is busbar itself, at the pin.
 [graph]
diff --git a/store-postgres-plugin/tests/admin_api_e2e.rs b/store-postgres-plugin/tests/admin_api_e2e.rs
index ef8a673..76875a4 100644
--- a/store-postgres-plugin/tests/admin_api_e2e.rs
+++ b/store-postgres-plugin/tests/admin_api_e2e.rs
@@ -277,6 +277,7 @@ fn build_real_binaries() -> (PathBuf, PathBuf) {
     ] {
         let status = Command::new("cargo")
             .args(args)
+            .env("BUSBAR_RELEASE_PUBKEY", E2E_RELEASE_PUBKEY)
             .current_dir(&root)
             .status()
             .expect("run cargo build for busbar + busbar-plugin-pack");
@@ -294,6 +295,33 @@ fn build_real_binaries() -> (PathBuf, PathBuf) {
     (release.join("busbar"), release.join("busbar-plugin-pack"))
 }
 
+/// THE TEST-ONLY FIRST-PARTY KEYPAIR (ed25519, `busbar-plugin-pack keygen`), never the release key.
+/// busbar grants the `operator-infrastructure` egress class this store's `tcp` need declares to a
+/// FIRST-PARTY plugin only (`busbar_plugin_loader::sign::egress_grant`): the busbar built here
+/// embeds the public half (`BUSBAR_RELEASE_PUBKEY`, compile time, as busbar's signing gate builds
+/// it) and the tarball is signed with the private half, so the plugin under test is first-party.
+/// Fixed, so the cached busbar build is reused across runs.
+const E2E_RELEASE_PUBKEY: &str = "9209607c315f66473c8cca8bf9a7b8031115d01bb47341613cebf57f0e4f271c";
+const E2E_RELEASE_PRIVKEY: &str =
+    "290f2453f236650ab21b85a95d49b9dab088518e829e4d524b01e441636ab327";
+
+/// The built busbar's version (`busbar --version`): a first-party plugin below it is refused by
+/// the first-party anti-downgrade floor, so the tarball is packed at exactly this version.
+fn busbar_version(busbar_bin: &std::path::Path) -> String {
+    let out = Command::new(busbar_bin)
+        .arg("--version")
+        .output()
+        .expect("run busbar --version");
+    let text = String::from_utf8_lossy(&out.stdout);
+    text.split_whitespace()
+        .find_map(|w| {
+            let v = w.trim_start_matches('v');
+            (v.split('.').count() == 3 && v.split('.').all(|p| p.parse::<u64>().is_ok()))
+                .then(|| v.to_owned())
+        })
+        .unwrap_or_else(|| panic!("busbar --version names no version: {text}"))
+}
+
 /// Reserve a free loopback port for the admin listener (bind-then-drop; the standard, small-TOCTOU
 /// pattern for handing a port to a spawned external process — the same trade-off `listen:
 /// "127.0.0.1:0"` in `e2e.rs` accepts for the data-plane listener, except busbar itself doesn't
@@ -394,7 +422,7 @@ fn install_over_admin_api_then_mint_a_key_and_verify_postgres_directly() {
             "--kind",
             "store",
             "--version",
-            "0.0.0-e2e",
+            busbar_version(&busbar_bin).as_str(),
             "--publisher",
             "busbar",
             "--description",
@@ -403,8 +431,8 @@ fn install_over_admin_api_then_mint_a_key_and_verify_postgres_directly() {
             "Apache-2.0",
             "--out",
             tarball_path.to_str().unwrap(),
-            "--allow-unsigned",
         ])
+        .env("BUSBAR_SIGN_KEY", E2E_RELEASE_PRIVKEY)
         .status()
         .expect("run busbar-plugin-pack");
     assert!(status.success(), "packing the plugin must succeed");
diff --git a/store-postgres-plugin/tests/e2e.rs b/store-postgres-plugin/tests/e2e.rs
index 146d574..565116f 100644
--- a/store-postgres-plugin/tests/e2e.rs
+++ b/store-postgres-plugin/tests/e2e.rs
@@ -348,6 +348,7 @@ fn build_real_binaries() -> (PathBuf, PathBuf) {
     ] {
         let status = Command::new("cargo")
             .args(args)
+            .env("BUSBAR_RELEASE_PUBKEY", E2E_RELEASE_PUBKEY)
             .current_dir(&root)
             .status()
             .expect("run cargo build for busbar + busbar-plugin-pack");
@@ -365,6 +366,33 @@ fn build_real_binaries() -> (PathBuf, PathBuf) {
     (release.join("busbar"), release.join("busbar-plugin-pack"))
 }
 
+/// THE TEST-ONLY FIRST-PARTY KEYPAIR (ed25519, `busbar-plugin-pack keygen`), never the release key.
+/// busbar grants the `operator-infrastructure` egress class this store's `tcp` need declares to a
+/// FIRST-PARTY plugin only (`busbar_plugin_loader::sign::egress_grant`): the busbar built here
+/// embeds the public half (`BUSBAR_RELEASE_PUBKEY`, compile time, as busbar's signing gate builds
+/// it) and the tarball is signed with the private half, so the plugin under test is first-party.
+/// Fixed, so the cached busbar build is reused across runs.
+const E2E_RELEASE_PUBKEY: &str = "9209607c315f66473c8cca8bf9a7b8031115d01bb47341613cebf57f0e4f271c";
+const E2E_RELEASE_PRIVKEY: &str =
+    "290f2453f236650ab21b85a95d49b9dab088518e829e4d524b01e441636ab327";
+
+/// The built busbar's version (`busbar --version`): a first-party plugin below it is refused by
+/// the first-party anti-downgrade floor, so the tarball is packed at exactly this version.
+fn busbar_version(busbar_bin: &std::path::Path) -> String {
+    let out = Command::new(busbar_bin)
+        .arg("--version")
+        .output()
+        .expect("run busbar --version");
+    let text = String::from_utf8_lossy(&out.stdout);
+    text.split_whitespace()
+        .find_map(|w| {
+            let v = w.trim_start_matches('v');
+            (v.split('.').count() == 3 && v.split('.').all(|p| p.parse::<u64>().is_ok()))
+                .then(|| v.to_owned())
+        })
+        .unwrap_or_else(|| panic!("busbar --version names no version: {text}"))
+}
+
 /// THE REAL END-TO-END INSTALL PROOF: pack the plugin, drop it in a real `plugins.dir`, run the real
 /// `busbar --validate` against a config naming `store: { module: postgres }` (trust/manifest gate
 /// proof), then boot a REAL `busbar` process (no `--validate`) and poll for real Postgres to
@@ -398,8 +426,8 @@ fn load_and_exercise_postgres_plugin_via_file_drop() {
     let plugins_dir = work.join("plugins");
     std::fs::create_dir_all(&plugins_dir).unwrap();
 
-    // Pack the real cdylib into a real signed-shape tarball via the same tool CI's SIGNOFF step
-    // uses, --allow-unsigned locally exactly like CI's own unsigned-key fallback.
+    // Pack the real cdylib into a real signed tarball via the same tool CI's SIGNOFF step uses,
+    // signed first-party with the test keypair (`E2E_RELEASE_PRIVKEY`) the busbar above embeds.
     let tarball = work.join("store-postgres.tar.gz");
     let status = Command::new(&pack_bin)
         .args([
@@ -413,7 +441,7 @@ fn load_and_exercise_postgres_plugin_via_file_drop() {
             "--kind",
             "store",
             "--version",
-            "0.0.0-e2e",
+            busbar_version(&busbar_bin).as_str(),
             "--publisher",
             "busbar",
             "--description",
@@ -422,8 +450,8 @@ fn load_and_exercise_postgres_plugin_via_file_drop() {
             "Apache-2.0",
             "--out",
             tarball.to_str().unwrap(),
-            "--allow-unsigned",
         ])
+        .env("BUSBAR_SIGN_KEY", E2E_RELEASE_PRIVKEY)
         .status()
         .expect("run busbar-plugin-pack");
     assert!(status.success(), "packing the plugin must succeed");
diff --git a/store-postgres-plugin/tests/support/conformance_host.rs b/store-postgres-plugin/tests/support/conformance_host.rs
index 069e5d3..d55de83 100644
--- a/store-postgres-plugin/tests/support/conformance_host.rs
+++ b/store-postgres-plugin/tests/support/conformance_host.rs
@@ -226,6 +226,7 @@ impl Opened {
             name: plugin.name().to_owned(),
             claims: stated.claims,
             composes_over: stated.composes_over,
+            status_rows: stated.status_rows,
         };
         Self { plugin, facts }
     }