diff --git a/package.json b/package.json
index 5d036d324..ed921cd33 100644
--- a/package.json
+++ b/package.json
@@ -268,7 +268,6 @@
   "dependencies": {
     "@limrun/api": "^0.24.5",
     "ipaddr.js": "^2.5.0",
-    "tar-stream": "^3.2.0",
     "undici": "7.29.0",
     "yaml": "^2.9.0",
     "yauzl": "^3.4.0"
@@ -323,6 +322,7 @@
     "oxlint": "^1.79.0",
     "pngjs": "^7.0.0",
     "publint": "^0.3.24",
+    "tar-stream": "^3.2.0",
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vite": "^8.2.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2a1365422..912aa254e 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -23,9 +23,6 @@ importers:
       ipaddr.js:
         specifier: ^2.5.0
         version: 2.5.0
-      tar-stream:
-        specifier: ^3.2.0
-        version: 3.2.0
       undici:
         specifier: ^7.29.0
         version: 7.29.0
@@ -159,6 +156,9 @@ importers:
       publint:
         specifier: ^0.3.24
         version: 0.3.24
+      tar-stream:
+        specifier: ^3.2.0
+        version: 3.2.0
       tsdown:
         specifier: ^0.22.14
         version: 0.22.14(@arethetypeswrong/core@0.18.5)(publint@0.3.24)(typescript@7.0.2)
diff --git a/tsdown.config.ts b/tsdown.config.ts
index 4230f51f9..c5a8b6636 100644
--- a/tsdown.config.ts
+++ b/tsdown.config.ts
@@ -76,8 +76,16 @@ export default defineConfig({
     'internal/update-check-entry': 'src/cli/update-check-entry.ts',
   },
   deps: {
-    alwaysBundle: [/^@agent-device\//, 'pngjs'],
-    onlyBundle: ['pngjs'],
+    alwaysBundle: [/^@agent-device\//, 'pngjs', 'tar-stream'],
+    onlyBundle: [
+      'pngjs',
+      'tar-stream',
+      'streamx',
+      'fast-fifo',
+      'b4a',
+      'text-decoder',
+      'events-universal',
+    ],
   },
   inputOptions: {
     // A build with missing workspace links resolves nothing under `alwaysBundle` and emits the