diff --git a/crates/trusted-server-adapter-fastly/src/main.rs b/crates/trusted-server-adapter-fastly/src/main.rs
index a14338ba..fef7f629 100644
--- a/crates/trusted-server-adapter-fastly/src/main.rs
+++ b/crates/trusted-server-adapter-fastly/src/main.rs
@@ -1,6 +1,10 @@
+use edgezero_core::body::Body as EdgeBody;
+use edgezero_core::http::{
+    header, HeaderName, HeaderValue, Method, Request as HttpRequest, Response as HttpResponse,
+};
 use error_stack::Report;
-use fastly::http::Method;
-use fastly::{Request, Response};
+use fastly::http::Method as FastlyMethod;
+use fastly::{Request as FastlyRequest, Response as FastlyResponse};
 
 use trusted_server_core::auction::endpoints::handle_auction;
 use trusted_server_core::auction::{build_orchestrator, AuctionOrchestrator};
@@ -10,7 +14,7 @@ use trusted_server_core::constants::{
     ENV_FASTLY_IS_STAGING, ENV_FASTLY_SERVICE_VERSION, HEADER_X_GEO_INFO_AVAILABLE,
     HEADER_X_TS_ENV, HEADER_X_TS_VERSION,
 };
-use trusted_server_core::error::TrustedServerError;
+use trusted_server_core::error::{IntoHttpResponse, TrustedServerError};
 use trusted_server_core::geo::GeoInfo;
 use trusted_server_core::integrations::IntegrationRegistry;
 use trusted_server_core::platform::RuntimeServices;
@@ -41,20 +45,17 @@ use crate::platform::{build_runtime_services, open_kv_store, UnavailableKvStore}
 
 /// Entry point for the Fastly Compute program.
 ///
-/// Uses an undecorated `main()` with `Request::from_client()` instead of
-/// `#[fastly::main]` so we can call `stream_to_client()` or `send_to_client()`
-/// explicitly. `#[fastly::main]` is syntactic sugar that auto-calls
-/// `send_to_client()` on the returned `Response`, which is incompatible with
-/// streaming.
+/// Uses an undecorated `main()` with `FastlyRequest::from_client()` instead of
+/// `#[fastly::main]` so we can call `send_to_client()` explicitly when needed.
 fn main() {
     init_logger();
 
-    let req = Request::from_client();
+    let mut req = FastlyRequest::from_client();
 
     // Keep the health probe independent from settings loading and routing so
     // readiness checks still get a cheap liveness response during startup.
-    if req.get_method() == Method::GET && req.get_path() == "/health" {
-        Response::from_status(200)
+    if req.get_method() == FastlyMethod::GET && req.get_path() == "/health" {
+        FastlyResponse::from_status(200)
             .with_body_text_plain("ok")
             .send_to_client();
         return;
@@ -89,24 +90,39 @@ fn main() {
         }
     };
 
-    // Start with an unavailable KV slot. Consent-dependent routes lazily
-    // replace it with the configured store at dispatch time so unrelated
-    // routes stay available when consent persistence is misconfigured.
     let kv_store = std::sync::Arc::new(UnavailableKvStore)
         as std::sync::Arc<dyn trusted_server_core::platform::PlatformKvStore>;
+    // Strip client-spoofable forwarded headers at the edge before building
+    // any request-derived context or converting to the core HTTP types.
+    compat::sanitize_fastly_forwarded_headers(&mut req);
+
     let runtime_services = build_runtime_services(&req, kv_store);
+    let http_req = compat::from_fastly_request(req);
 
-    // route_request may send the response directly (streaming path) or
-    // return it for us to send (buffered path).
-    if let Some(response) = futures::executor::block_on(route_request(
+    let mut response = futures::executor::block_on(route_request(
         &settings,
         &orchestrator,
         &integration_registry,
         &runtime_services,
-        req,
-    )) {
-        response.send_to_client();
-    }
+        http_req,
+    ))
+    .unwrap_or_else(|e| http_error_response(&e));
+
+    let geo_info = if response.status() == edgezero_core::http::StatusCode::UNAUTHORIZED {
+        None
+    } else {
+        runtime_services
+            .geo()
+            .lookup(runtime_services.client_info().client_ip)
+            .unwrap_or_else(|e| {
+                log::warn!("geo lookup failed: {e}");
+                None
+            })
+    };
+
+    finalize_response(&settings, geo_info.as_ref(), &mut response);
+
+    compat::to_fastly_response(response).send_to_client();
 }
 
 async fn route_request(
@@ -114,48 +130,23 @@ async fn route_request(
     orchestrator: &AuctionOrchestrator,
     integration_registry: &IntegrationRegistry,
     runtime_services: &RuntimeServices,
-    mut req: Request,
-) -> Option<Response> {
-    // Strip client-spoofable forwarded headers at the edge.
-    // On Fastly this service IS the first proxy — these headers from
-    // clients are untrusted and can hijack URL rewriting (see #409).
-    compat::sanitize_fastly_forwarded_headers(&mut req);
-
-    // Look up geo info via the platform abstraction using the client IP
-    // already captured in RuntimeServices at the entry point.
-    let geo_info = runtime_services
-        .geo()
-        .lookup(runtime_services.client_info().client_ip)
-        .unwrap_or_else(|e| {
-            log::warn!("geo lookup failed: {e}");
-            None
-        });
-
+    req: HttpRequest,
+) -> Result<HttpResponse, Report<TrustedServerError>> {
     // `get_settings()` should already have rejected invalid handler regexes.
     // Keep this fallback so manually-constructed or otherwise unprepared
     // settings still become an error response instead of panicking.
-    let auth_req = compat::from_fastly_headers_ref(&req);
-    match enforce_basic_auth(settings, &auth_req) {
-        Ok(Some(response)) => {
-            let mut response = compat::to_fastly_response(response);
-            finalize_response(settings, geo_info.as_ref(), &mut response);
-            return Some(response);
-        }
+    match enforce_basic_auth(settings, &req) {
+        Ok(Some(response)) => return Ok(response),
         Ok(None) => {}
-        Err(e) => {
-            log::error!("Failed to evaluate basic auth: {:?}", e);
-            let mut response = to_error_response(&e);
-            finalize_response(settings, geo_info.as_ref(), &mut response);
-            return Some(response);
-        }
+        Err(e) => return Err(e),
     }
 
     // Get path and method for routing
-    let path = req.get_path().to_string();
-    let method = req.get_method().clone();
+    let path = req.uri().path().to_string();
+    let method = req.method().clone();
 
     // Match known routes and handle them
-    let result = match (method, path.as_str()) {
+    match (method, path.as_str()) {
         // Serve the tsjs library
         (Method::GET, path) if path.starts_with("/static/tsjs=") => {
             handle_tsjs_dynamic(&req, integration_registry)
@@ -201,14 +192,24 @@ async fn route_request(
         (Method::POST, "/first-party/proxy-rebuild") => {
             handle_first_party_proxy_rebuild(settings, runtime_services, req).await
         }
-        (m, path) if integration_registry.has_route(&m, path) => integration_registry
-            .handle_proxy(&m, path, settings, runtime_services, req)
-            .await
-            .unwrap_or_else(|| {
-                Err(Report::new(TrustedServerError::BadRequest {
-                    message: format!("Unknown integration route: {path}"),
-                }))
-            }),
+        (m, path) if integration_registry.has_route(&m, path) => {
+            // TODO(PR13): migrate integration trait to http types here
+            integration_registry
+                .handle_proxy(
+                    &m,
+                    path,
+                    settings,
+                    runtime_services,
+                    compat::to_fastly_request(req),
+                )
+                .await
+                .unwrap_or_else(|| {
+                    Err(Report::new(TrustedServerError::BadRequest {
+                        message: format!("Unknown integration route: {path}"),
+                    }))
+                })
+                .map(compat::from_fastly_response)
+        }
 
         // No known route matched, proxy to publisher origin as fallback
         _ => {
@@ -218,64 +219,48 @@ async fn route_request(
             );
 
             match runtime_services_for_consent_route(settings, runtime_services) {
-                Ok(publisher_services) => {
-                    match handle_publisher_request(
-                        settings,
-                        integration_registry,
-                        &publisher_services,
-                        req,
-                    ) {
-                        Ok(PublisherResponse::Stream {
-                            mut response,
-                            body,
-                            params,
-                        }) => {
-                            // Streaming path: finalize headers, then stream body to client.
-                            finalize_response(settings, geo_info.as_ref(), &mut response);
-                            let mut streaming_body = response.stream_to_client();
-                            if let Err(e) = stream_publisher_body(
-                                body,
-                                &mut streaming_body,
-                                &params,
-                                settings,
-                                integration_registry,
-                            ) {
-                                // Headers already committed. Log and abort — client
-                                // sees a truncated response. Standard proxy behavior.
-                                log::error!("Streaming processing failed: {e:?}");
-                                drop(streaming_body);
-                            } else if let Err(e) = streaming_body.finish() {
-                                log::error!("Failed to finish streaming body: {e}");
-                            }
-                            // Response already sent via stream_to_client()
-                            return None;
-                        }
-                        Ok(PublisherResponse::PassThrough { mut response, body }) => {
-                            // Binary pass-through: reattach body and send via send_to_client().
-                            // This preserves Content-Length and avoids chunked encoding overhead.
-                            // Fastly streams the body from its internal buffer — no WASM
-                            // memory buffering occurs.
-                            response.set_body(body);
-                            Ok(response)
-                        }
-                        Ok(PublisherResponse::Buffered(response)) => Ok(response),
-                        Err(e) => {
-                            log::error!("Failed to proxy to publisher origin: {:?}", e);
-                            Err(e)
-                        }
-                    }
-                }
+                Ok(publisher_services) => handle_publisher_request(
+                    settings,
+                    integration_registry,
+                    &publisher_services,
+                    req,
+                )
+                .await
+                .and_then(|pub_response| {
+                    resolve_publisher_response(pub_response, settings, integration_registry)
+                }),
                 Err(e) => Err(e),
             }
         }
-    };
-
-    // Convert any errors to HTTP error responses
-    let mut response = result.unwrap_or_else(|e| to_error_response(&e));
-
-    finalize_response(settings, geo_info.as_ref(), &mut response);
+    }
+}
 
-    Some(response)
+fn resolve_publisher_response(
+    publisher_response: PublisherResponse,
+    settings: &Settings,
+    integration_registry: &IntegrationRegistry,
+) -> Result<HttpResponse, Report<TrustedServerError>> {
+    match publisher_response {
+        PublisherResponse::Buffered(response) => Ok(response),
+        PublisherResponse::Stream {
+            mut response,
+            body,
+            params,
+        } => {
+            let mut output = Vec::new();
+            stream_publisher_body(body, &mut output, &params, settings, integration_registry)?;
+            response.headers_mut().insert(
+                header::CONTENT_LENGTH,
+                HeaderValue::from(output.len() as u64),
+            );
+            *response.body_mut() = EdgeBody::from(output);
+            Ok(response)
+        }
+        PublisherResponse::PassThrough { mut response, body } => {
+            *response.body_mut() = body;
+            Ok(response)
+        }
+    }
 }
 
 fn runtime_services_for_consent_route(
@@ -304,21 +289,48 @@ fn runtime_services_for_consent_route(
 /// Header precedence (last write wins): geo headers are set first, then
 /// version/staging, then operator-configured `settings.response_headers`.
 /// This means operators can intentionally override any managed header.
-fn finalize_response(settings: &Settings, geo_info: Option<&GeoInfo>, response: &mut Response) {
+fn finalize_response(settings: &Settings, geo_info: Option<&GeoInfo>, response: &mut HttpResponse) {
     if let Some(geo) = geo_info {
         geo.set_response_headers(response);
     } else {
-        response.set_header(HEADER_X_GEO_INFO_AVAILABLE, "false");
+        response.headers_mut().insert(
+            HEADER_X_GEO_INFO_AVAILABLE,
+            HeaderValue::from_static("false"),
+        );
     }
 
     if let Ok(v) = ::std::env::var(ENV_FASTLY_SERVICE_VERSION) {
-        response.set_header(HEADER_X_TS_VERSION, v);
+        if let Ok(value) = HeaderValue::from_str(&v) {
+            response.headers_mut().insert(HEADER_X_TS_VERSION, value);
+        } else {
+            log::warn!("Skipping invalid FASTLY_SERVICE_VERSION response header value");
+        }
     }
     if ::std::env::var(ENV_FASTLY_IS_STAGING).as_deref() == Ok("1") {
-        response.set_header(HEADER_X_TS_ENV, "staging");
+        response
+            .headers_mut()
+            .insert(HEADER_X_TS_ENV, HeaderValue::from_static("staging"));
     }
 
     for (key, value) in &settings.response_headers {
-        response.set_header(key, value);
+        let header_name = HeaderName::from_bytes(key.as_bytes())
+            .expect("settings.response_headers validated at load time");
+        let header_value =
+            HeaderValue::from_str(value).expect("settings.response_headers validated at load time");
+        response.headers_mut().insert(header_name, header_value);
     }
 }
+
+fn http_error_response(report: &Report<TrustedServerError>) -> HttpResponse {
+    let root_error = report.current_context();
+    log::error!("Error occurred: {:?}", report);
+
+    let mut response =
+        HttpResponse::new(EdgeBody::from(format!("{}\n", root_error.user_message())));
+    *response.status_mut() = root_error.status_code();
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("text/plain; charset=utf-8"),
+    );
+    response
+}
diff --git a/crates/trusted-server-adapter-fastly/src/route_tests.rs b/crates/trusted-server-adapter-fastly/src/route_tests.rs
index 0fd0113f..aa1843a2 100644
--- a/crates/trusted-server-adapter-fastly/src/route_tests.rs
+++ b/crates/trusted-server-adapter-fastly/src/route_tests.rs
@@ -6,6 +6,8 @@ use error_stack::Report;
 use fastly::http::StatusCode;
 use fastly::Request;
 use trusted_server_core::auction::build_orchestrator;
+use trusted_server_core::compat;
+use trusted_server_core::error::IntoHttpResponse;
 use trusted_server_core::integrations::IntegrationRegistry;
 use trusted_server_core::platform::{
     ClientInfo, GeoInfo, PlatformBackend, PlatformBackendSpec, PlatformConfigStore, PlatformError,
@@ -185,66 +187,73 @@ fn configured_missing_consent_store_only_breaks_consent_routes() {
     let integration_registry =
         IntegrationRegistry::new(&settings).expect("should create integration registry");
 
-    let discovery_req = Request::get("https://test.com/.well-known/trusted-server.json");
-    let discovery_services = test_runtime_services(&discovery_req);
+    let discovery_fastly_req = Request::get("https://test.com/.well-known/trusted-server.json");
+    let discovery_services = test_runtime_services(&discovery_fastly_req);
     let discovery_resp = futures::executor::block_on(route_request(
         &settings,
         &orchestrator,
         &integration_registry,
         &discovery_services,
-        discovery_req,
+        compat::from_fastly_request(discovery_fastly_req),
     ))
     .expect("should route discovery request");
     assert_eq!(
-        discovery_resp.get_status(),
+        discovery_resp.status(),
         StatusCode::OK,
         "should keep discovery available when the consent store is unavailable"
     );
 
-    let admin_req = Request::post("https://test.com/admin/keys/rotate");
-    let admin_services = test_runtime_services(&admin_req);
+    let admin_fastly_req = Request::post("https://test.com/admin/keys/rotate");
+    let admin_services = test_runtime_services(&admin_fastly_req);
     let admin_resp = futures::executor::block_on(route_request(
         &settings,
         &orchestrator,
         &integration_registry,
         &admin_services,
-        admin_req,
+        compat::from_fastly_request(admin_fastly_req),
     ))
     .expect("should route admin request");
     assert_eq!(
-        admin_resp.get_status(),
+        admin_resp.status(),
         StatusCode::UNAUTHORIZED,
         "should keep admin auth behavior unchanged when the consent store is unavailable"
     );
 
-    let auction_req = Request::post("https://test.com/auction").with_body(r#"{"adUnits":[]}"#);
-    let auction_services = test_runtime_services(&auction_req);
-    let auction_resp = futures::executor::block_on(route_request(
+    let auction_fastly_req =
+        Request::post("https://test.com/auction").with_body(r#"{"adUnits":[]}"#);
+    let auction_services = test_runtime_services(&auction_fastly_req);
+    let auction_result = futures::executor::block_on(route_request(
         &settings,
         &orchestrator,
         &integration_registry,
         &auction_services,
-        auction_req,
-    ))
-    .expect("should return an error response for auction requests");
+        compat::from_fastly_request(auction_fastly_req),
+    ));
+    let auction_status = match auction_result {
+        Ok(resp) => resp.status(),
+        Err(ref e) => e.current_context().status_code(),
+    };
     assert_eq!(
-        auction_resp.get_status(),
+        auction_status,
         StatusCode::SERVICE_UNAVAILABLE,
         "should fail auction requests when consent persistence is configured but unavailable"
     );
 
-    let publisher_req = Request::get("https://test.com/articles/example");
-    let publisher_services = test_runtime_services(&publisher_req);
-    let publisher_resp = futures::executor::block_on(route_request(
+    let publisher_fastly_req = Request::get("https://test.com/articles/example");
+    let publisher_services = test_runtime_services(&publisher_fastly_req);
+    let publisher_result = futures::executor::block_on(route_request(
         &settings,
         &orchestrator,
         &integration_registry,
         &publisher_services,
-        publisher_req,
-    ))
-    .expect("should return an error response for publisher fallback");
+        compat::from_fastly_request(publisher_fastly_req),
+    ));
+    let publisher_status = match publisher_result {
+        Ok(resp) => resp.status(),
+        Err(ref e) => e.current_context().status_code(),
+    };
     assert_eq!(
-        publisher_resp.get_status(),
+        publisher_status,
         StatusCode::SERVICE_UNAVAILABLE,
         "should scope consent store failures to the consent-dependent routes"
     );
diff --git a/crates/trusted-server-core/src/auction/endpoints.rs b/crates/trusted-server-core/src/auction/endpoints.rs
index df51a8fe..62d7e292 100644
--- a/crates/trusted-server-core/src/auction/endpoints.rs
+++ b/crates/trusted-server-core/src/auction/endpoints.rs
@@ -1,7 +1,8 @@
 //! HTTP endpoint handlers for auction requests.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use fastly::{Request, Response};
+use http::{Request, Response};
 
 use crate::auction::formats::AdRequest;
 use crate::compat;
@@ -16,6 +17,8 @@ use super::formats::{convert_to_openrtb_response, convert_tsjs_to_auction_reques
 use super::types::AuctionContext;
 use super::AuctionOrchestrator;
 
+const AUCTION_MAX_BODY_BYTES: usize = 65536;
+
 /// Handle auction request from /auction endpoint.
 ///
 /// This is the main entry point for running header bidding auctions.
@@ -33,35 +36,45 @@ pub async fn handle_auction(
     settings: &Settings,
     orchestrator: &AuctionOrchestrator,
     services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    let (parts, body) = req.into_parts();
+
     // Parse request body
-    let body: AdRequest = serde_json::from_slice(&req.take_body_bytes()).change_context(
-        TrustedServerError::Auction {
+    let body_bytes = body.into_bytes();
+    if body_bytes.len() > AUCTION_MAX_BODY_BYTES {
+        return Err(Report::new(TrustedServerError::RequestTooLarge {
+            message: format!(
+                "auction payload {} exceeds limit of {}",
+                body_bytes.len(),
+                AUCTION_MAX_BODY_BYTES,
+            ),
+        }));
+    }
+    let body: AdRequest =
+        serde_json::from_slice(&body_bytes).change_context(TrustedServerError::Auction {
             message: "Failed to parse auction request body".to_string(),
-        },
-    )?;
+        })?;
 
     log::info!(
         "Auction request received for {} ad units",
         body.ad_units.len()
     );
 
-    let http_req = compat::from_fastly_headers_ref(&req);
+    let http_req = Request::from_parts(parts, EdgeBody::empty());
 
     // Generate EC ID early so the consent pipeline can use it for
     // KV Store fallback/write operations.
-    let ec_id = get_or_generate_ec_id(settings, services, &req).change_context(
+    let ec_id = get_or_generate_ec_id(settings, services, &http_req).change_context(
         TrustedServerError::Auction {
             message: "Failed to generate EC ID".to_string(),
         },
     )?;
 
-    // Extract consent from request cookies, headers, and geo.
     let cookie_jar = handle_request_cookies(&http_req)?;
     let geo = services
         .geo()
-        .lookup(services.client_info.client_ip)
+        .lookup(services.client_info().client_ip)
         .unwrap_or_else(|e| {
             log::warn!("geo lookup failed: {e}");
             None
@@ -84,17 +97,20 @@ pub async fn handle_auction(
         &body,
         settings,
         services,
-        &req,
+        &http_req,
         consent_context,
         &ec_id,
         geo,
     )?;
 
+    // Body already parsed above; provider context only needs request metadata.
+    let fastly_req = compat::to_fastly_request_ref(&http_req);
+
     // Create auction context
     let context = AuctionContext {
         settings,
-        request: &req,
-        client_info: &services.client_info,
+        request: &fastly_req,
+        client_info: services.client_info(),
         timeout_ms: settings.auction.timeout_ms,
         provider_responses: None,
         services,
@@ -118,3 +134,36 @@ pub async fn handle_auction(
     // Convert to OpenRTB response format with inline creative HTML
     convert_to_openrtb_response(&result, settings, &auction_request)
 }
+
+#[cfg(test)]
+mod tests {
+    use edgezero_core::body::Body as EdgeBody;
+    use http::{Method, Request as HttpRequest, StatusCode};
+
+    use crate::auction::build_orchestrator;
+    use crate::error::IntoHttpResponse;
+    use crate::platform::test_support::noop_services;
+    use crate::test_support::tests::create_test_settings;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn auction_rejects_oversized_body() {
+        let settings = create_test_settings();
+        let orchestrator = build_orchestrator(&settings).expect("should build orchestrator");
+        let oversized = vec![b'x'; AUCTION_MAX_BODY_BYTES + 1];
+        let req = HttpRequest::builder()
+            .method(Method::POST)
+            .uri("https://test.com/auction")
+            .body(EdgeBody::from(oversized))
+            .expect("should build request");
+        let err = handle_auction(&settings, &orchestrator, &noop_services(), req)
+            .await
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for auction body over limit"
+        );
+    }
+}
diff --git a/crates/trusted-server-core/src/auction/formats.rs b/crates/trusted-server-core/src/auction/formats.rs
index 5237921a..e3d3e075 100644
--- a/crates/trusted-server-core/src/auction/formats.rs
+++ b/crates/trusted-server-core/src/auction/formats.rs
@@ -4,9 +4,9 @@
 //! - Parsing incoming tsjs/Prebid.js format requests
 //! - Converting internal auction results to `OpenRTB` 2.x responses
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{ensure, Report, ResultExt};
-use fastly::http::{header, StatusCode};
-use fastly::{Request, Response};
+use http::{header, HeaderValue, Request, Response, StatusCode};
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
 use std::collections::HashMap;
@@ -84,7 +84,7 @@ pub fn convert_tsjs_to_auction_request(
     body: &AdRequest,
     settings: &Settings,
     services: &RuntimeServices,
-    req: &Request,
+    req: &Request<EdgeBody>,
     consent: ConsentContext,
     ec_id: &str,
     geo: Option<GeoInfo>,
@@ -138,8 +138,10 @@ pub fn convert_tsjs_to_auction_request(
     // Build device info with user-agent (always) and geo (if available)
     let device = Some(DeviceInfo {
         user_agent: req
-            .get_header_str("user-agent")
-            .map(std::string::ToString::to_string),
+            .headers()
+            .get(header::USER_AGENT)
+            .and_then(|value| value.to_str().ok())
+            .map(str::to_string),
         ip: services.client_info.client_ip.map(|ip| ip.to_string()),
         geo,
     });
@@ -212,7 +214,7 @@ pub fn convert_to_openrtb_response(
     result: &OrchestrationResult,
     settings: &Settings,
     auction_request: &AuctionRequest,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // Build OpenRTB-style seatbid array
     let mut seatbids = Vec::with_capacity(result.winning_bids.len());
 
@@ -312,9 +314,170 @@ pub fn convert_to_openrtb_response(
             message: "Failed to serialize auction response".to_string(),
         })?;
 
-    Ok(Response::from_status(StatusCode::OK)
-        .with_header(header::CONTENT_TYPE, "application/json")
-        .with_header(HEADER_X_TS_EC, &auction_request.user.id)
-        .with_header(HEADER_X_TS_EC_FRESH, &auction_request.user.fresh_id)
-        .with_body(body_bytes))
+    let mut response = Response::new(EdgeBody::from(body_bytes));
+    *response.status_mut() = StatusCode::OK;
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json"),
+    );
+    insert_response_header(
+        response.headers_mut(),
+        &HEADER_X_TS_EC,
+        auction_request.user.id.as_str(),
+    )?;
+    insert_response_header(
+        response.headers_mut(),
+        &HEADER_X_TS_EC_FRESH,
+        auction_request.user.fresh_id.as_str(),
+    )?;
+
+    Ok(response)
+}
+
+fn insert_response_header(
+    headers: &mut http::HeaderMap,
+    name: &http::HeaderName,
+    value: &str,
+) -> Result<(), Report<TrustedServerError>> {
+    let header_value =
+        HeaderValue::from_str(value).change_context(TrustedServerError::InvalidHeaderValue {
+            message: format!("Invalid response header value for {name}"),
+        })?;
+    headers.insert(name.clone(), header_value);
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::auction::{AuctionResponse, Bid};
+    use crate::consent::ConsentContext;
+    use crate::platform::test_support::noop_services;
+    use crate::test_support::tests::{create_test_settings, VALID_SYNTHETIC_ID};
+    use edgezero_core::body::Body as EdgeBody;
+    use http::{header, Method, Request as HttpRequest, StatusCode};
+
+    fn sample_ad_request() -> AdRequest {
+        AdRequest {
+            ad_units: vec![AdUnit {
+                code: "slot-1".to_string(),
+                media_types: Some(MediaTypes {
+                    banner: Some(BannerUnit {
+                        sizes: vec![vec![300, 250]],
+                    }),
+                }),
+                bids: Some(vec![BidConfig {
+                    bidder: "prebid".to_string(),
+                    params: serde_json::json!({"placementId": "abc"}),
+                }]),
+            }],
+            config: None,
+        }
+    }
+
+    fn sample_auction_request() -> AuctionRequest {
+        AuctionRequest {
+            id: "auction-123".to_string(),
+            slots: vec![AdSlot {
+                id: "slot-1".to_string(),
+                formats: vec![AdFormat {
+                    media_type: MediaType::Banner,
+                    width: 300,
+                    height: 250,
+                }],
+                floor_price: None,
+                targeting: HashMap::new(),
+                bidders: HashMap::new(),
+            }],
+            publisher: PublisherInfo {
+                domain: "publisher.example".to_string(),
+                page_url: Some("https://publisher.example/page".to_string()),
+            },
+            user: UserInfo {
+                id: VALID_SYNTHETIC_ID.to_string(),
+                fresh_id: "fresh-123".to_string(),
+                consent: Some(ConsentContext::default()),
+            },
+            device: None,
+            site: Some(SiteInfo {
+                domain: "publisher.example".to_string(),
+                page: "https://publisher.example/page".to_string(),
+            }),
+            context: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn convert_tsjs_to_auction_request_accepts_http_request() {
+        let settings = create_test_settings();
+        let req = HttpRequest::builder()
+            .method(Method::POST)
+            .uri("https://publisher.example/auction")
+            .header(header::USER_AGENT, "test-agent")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let auction_request = convert_tsjs_to_auction_request(
+            &sample_ad_request(),
+            &settings,
+            &noop_services(),
+            &req,
+            ConsentContext::default(),
+            VALID_SYNTHETIC_ID,
+            None,
+        )
+        .expect("should convert auction request");
+
+        assert_eq!(auction_request.slots.len(), 1, "should create one slot");
+        assert_eq!(
+            auction_request.slots[0].id, "slot-1",
+            "should preserve slot code"
+        );
+    }
+
+    #[test]
+    fn convert_to_openrtb_response_returns_http_response_with_ec_headers() {
+        let settings = create_test_settings();
+        let bid = Bid {
+            slot_id: "slot-1".to_string(),
+            price: Some(1.25),
+            currency: "USD".to_string(),
+            creative: Some("<div>creative</div>".to_string()),
+            adomain: Some(vec!["advertiser.example".to_string()]),
+            bidder: "prebid".to_string(),
+            width: 300,
+            height: 250,
+            nurl: None,
+            burl: None,
+            metadata: HashMap::new(),
+        };
+        let result = OrchestrationResult {
+            provider_responses: vec![AuctionResponse::success("prebid", vec![bid.clone()], 12)],
+            mediator_response: None,
+            winning_bids: HashMap::from([(String::from("slot-1"), bid)]),
+            total_time_ms: 12,
+            metadata: HashMap::new(),
+        };
+
+        let response = convert_to_openrtb_response(&result, &settings, &sample_auction_request())
+            .expect("should convert to openrtb response");
+
+        assert_eq!(response.status(), StatusCode::OK, "should return 200 OK");
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .and_then(|value| value.to_str().ok()),
+            Some("application/json"),
+            "should return json content type"
+        );
+        assert_eq!(
+            response
+                .headers()
+                .get(&crate::constants::HEADER_X_TS_EC)
+                .and_then(|value| value.to_str().ok()),
+            Some(VALID_SYNTHETIC_ID),
+            "should include EC ID header"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/auction/orchestrator.rs b/crates/trusted-server-core/src/auction/orchestrator.rs
index 9cbcd2b9..7c3ed6c0 100644
--- a/crates/trusted-server-core/src/auction/orchestrator.rs
+++ b/crates/trusted-server-core/src/auction/orchestrator.rs
@@ -5,9 +5,9 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::time::{Duration, Instant};
 
+use crate::compat::platform_response_to_fastly;
 use crate::error::TrustedServerError;
 use crate::platform::{PlatformPendingRequest, RuntimeServices};
-use crate::proxy::platform_response_to_fastly;
 
 use super::config::AuctionConfig;
 use super::provider::AuctionProvider;
diff --git a/crates/trusted-server-core/src/compat.rs b/crates/trusted-server-core/src/compat.rs
index 4c6d5372..24922226 100644
--- a/crates/trusted-server-core/src/compat.rs
+++ b/crates/trusted-server-core/src/compat.rs
@@ -6,10 +6,13 @@
 //! # PR 15 removal target
 
 use edgezero_core::body::Body as EdgeBody;
+use error_stack::Report;
 use fastly::http::header;
 
 use crate::constants::INTERNAL_HEADERS;
+use crate::error::TrustedServerError;
 use crate::http_util::SPOOFABLE_FORWARDED_HEADERS;
+use crate::platform::PlatformResponse;
 
 fn build_http_request(req: &fastly::Request, body: EdgeBody) -> http::Request<EdgeBody> {
     let uri: http::Uri = req.get_url_str().parse().unwrap_or_else(|_| {
@@ -35,6 +38,20 @@ fn build_http_request(req: &fastly::Request, body: EdgeBody) -> http::Request<Ed
         .expect("should build http request from fastly request")
 }
 
+/// Convert an owned `fastly::Request` into an `http::Request<EdgeBody>`.
+///
+/// # PR 15 removal target
+///
+/// # Panics
+///
+/// Does not panic in practice — URL parse failure falls back to `"/"` (logged
+/// as a warning), and the subsequent `builder.body()` cannot fail given a valid
+/// method and URI. Listed here only because clippy cannot prove it statically.
+pub fn from_fastly_request(mut req: fastly::Request) -> http::Request<EdgeBody> {
+    let body = EdgeBody::from(req.take_body_bytes());
+    build_http_request(&req, body)
+}
+
 /// Convert a borrowed `fastly::Request` into an `http::Request<EdgeBody>` for reading.
 ///
 /// Headers are copied; the body is empty.
@@ -50,6 +67,64 @@ pub fn from_fastly_headers_ref(req: &fastly::Request) -> http::Request<EdgeBody>
     build_http_request(req, EdgeBody::empty())
 }
 
+/// Convert an `http::Request<EdgeBody>` into a `fastly::Request`.
+///
+/// # PR 15 removal target
+pub fn to_fastly_request(req: http::Request<EdgeBody>) -> fastly::Request {
+    let (parts, body) = req.into_parts();
+    let mut fastly_req = fastly::Request::new(parts.method, parts.uri.to_string());
+    for (name, value) in &parts.headers {
+        fastly_req.append_header(name.as_str(), value.as_bytes());
+    }
+
+    match body {
+        EdgeBody::Once(bytes) => {
+            if !bytes.is_empty() {
+                fastly_req.set_body(bytes.to_vec());
+            }
+        }
+        EdgeBody::Stream(_) => {
+            log::warn!("streaming body in compat::to_fastly_request; body will be empty");
+        }
+    }
+
+    fastly_req
+}
+
+/// Convert a borrowed `http::Request<EdgeBody>` into a `fastly::Request`.
+///
+/// Headers, method, and URI are copied; the body is empty.
+///
+/// # PR 15 removal target
+pub fn to_fastly_request_ref(req: &http::Request<EdgeBody>) -> fastly::Request {
+    let mut fastly_req = fastly::Request::new(req.method().clone(), req.uri().to_string());
+    for (name, value) in req.headers() {
+        fastly_req.append_header(name.as_str(), value.as_bytes());
+    }
+
+    fastly_req
+}
+
+/// Convert a `fastly::Response` into an `http::Response<EdgeBody>`.
+///
+/// # PR 15 removal target
+///
+/// # Panics
+///
+/// Panics if the copied Fastly response parts cannot form a valid
+/// `http::Response`.
+pub fn from_fastly_response(mut resp: fastly::Response) -> http::Response<EdgeBody> {
+    let status = resp.get_status();
+    let mut builder = http::Response::builder().status(status);
+    for (name, value) in resp.get_headers() {
+        builder = builder.header(name.as_str(), value.as_bytes());
+    }
+
+    builder
+        .body(EdgeBody::from(resp.take_body_bytes()))
+        .expect("should build http response from fastly response")
+}
+
 /// Convert an `http::Response<EdgeBody>` into a `fastly::Response`.
 ///
 /// # PR 15 removal target
@@ -172,6 +247,33 @@ pub fn expire_fastly_ec_cookie(
     );
 }
 
+/// Converts a [`PlatformResponse`] into a [`fastly::Response`].
+///
+/// # Errors
+///
+/// - [`TrustedServerError::Proxy`] if `platform_resp` carries a streaming body,
+///   which this Fastly-only conversion path cannot materialise.
+pub(crate) fn platform_response_to_fastly(
+    platform_resp: PlatformResponse,
+) -> Result<fastly::Response, Report<TrustedServerError>> {
+    let (parts, body) = platform_resp.response.into_parts();
+    let body_bytes = match body {
+        EdgeBody::Once(bytes) => bytes.to_vec(),
+        EdgeBody::Stream(_) => {
+            return Err(Report::new(TrustedServerError::Proxy {
+                message: "streaming platform response body is not supported by Fastly response conversion"
+                    .to_string(),
+            }));
+        }
+    };
+    let mut resp = fastly::Response::from_status(parts.status.as_u16());
+    for (name, value) in parts.headers.iter() {
+        resp.append_header(name.as_str(), value.as_bytes());
+    }
+    resp.set_body(body_bytes);
+    Ok(resp)
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -234,6 +336,104 @@ mod tests {
         assert_once_body_eq(http_req.into_body(), b"");
     }
 
+    #[test]
+    fn from_fastly_request_copies_body() {
+        let mut fastly_req =
+            fastly::Request::new(fastly::http::Method::POST, "https://example.com/path");
+        fastly_req.set_header("content-type", "application/json");
+        fastly_req.set_body(r#"{"ok":true}"#);
+
+        let http_req = from_fastly_request(fastly_req);
+        let (parts, body) = http_req.into_parts();
+
+        assert_eq!(parts.method, http::Method::POST, "should copy method");
+        assert_eq!(parts.uri.path(), "/path", "should copy uri path");
+        assert_eq!(
+            parts
+                .headers
+                .get("content-type")
+                .and_then(|v| v.to_str().ok()),
+            Some("application/json"),
+            "should copy headers"
+        );
+        assert_once_body_eq(body, br#"{"ok":true}"#);
+    }
+
+    #[test]
+    fn to_fastly_request_copies_headers_and_body() {
+        let http_req = http::Request::builder()
+            .method(http::Method::POST)
+            .uri("https://example.com/submit")
+            .header("x-custom", "value")
+            .body(EdgeBody::from(b"payload".as_ref()))
+            .expect("should build request");
+
+        let mut fastly_req = to_fastly_request(http_req);
+
+        assert_eq!(
+            fastly_req.get_method(),
+            &fastly::http::Method::POST,
+            "should copy method"
+        );
+        assert_eq!(
+            fastly_req
+                .get_header("x-custom")
+                .and_then(|v| v.to_str().ok()),
+            Some("value"),
+            "should copy headers"
+        );
+        assert_eq!(
+            fastly_req.take_body_bytes().as_slice(),
+            b"payload",
+            "should copy body bytes"
+        );
+    }
+
+    #[test]
+    fn to_fastly_request_preserves_duplicate_headers() {
+        let http_req = http::Request::builder()
+            .method(http::Method::GET)
+            .uri("https://example.com/")
+            .header("x-custom", "first")
+            .header("x-custom", "second")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let fastly_req = to_fastly_request(http_req);
+
+        let values: Vec<_> = fastly_req
+            .get_headers()
+            .filter(|(name, _)| name.as_str() == "x-custom")
+            .map(|(_, value)| value.to_str().expect("should be valid utf8"))
+            .collect();
+        assert_eq!(
+            values,
+            vec!["first", "second"],
+            "should preserve duplicate headers"
+        );
+    }
+
+    #[test]
+    fn from_fastly_response_copies_status_headers_and_body() {
+        let mut fastly_resp = fastly::Response::from_status(202);
+        fastly_resp.set_header("content-type", "application/json");
+        fastly_resp.set_body(r#"{"ok":true}"#);
+
+        let http_resp = from_fastly_response(fastly_resp);
+        let (parts, body) = http_resp.into_parts();
+
+        assert_eq!(parts.status.as_u16(), 202, "should copy status");
+        assert_eq!(
+            parts
+                .headers
+                .get("content-type")
+                .and_then(|v| v.to_str().ok()),
+            Some("application/json"),
+            "should copy headers"
+        );
+        assert_once_body_eq(body, br#"{"ok":true}"#);
+    }
+
     #[test]
     fn to_fastly_response_copies_status_and_headers() {
         let http_resp = http::Response::builder()
@@ -251,6 +451,64 @@ mod tests {
         );
     }
 
+    #[test]
+    fn to_fastly_request_ref_copies_method_uri_and_headers_without_body() {
+        let http_req = http::Request::builder()
+            .method(http::Method::POST)
+            .uri("https://example.com/path?q=1")
+            .header("x-custom", "value")
+            .body(EdgeBody::from(b"payload".as_ref()))
+            .expect("should build request");
+
+        let mut fastly_req = to_fastly_request_ref(&http_req);
+
+        assert_eq!(
+            fastly_req.get_method(),
+            &fastly::http::Method::POST,
+            "should copy method"
+        );
+        assert_eq!(
+            fastly_req.get_url_str(),
+            "https://example.com/path?q=1",
+            "should copy URI"
+        );
+        assert_eq!(
+            fastly_req
+                .get_header("x-custom")
+                .and_then(|v| v.to_str().ok()),
+            Some("value"),
+            "should copy headers"
+        );
+        assert!(
+            fastly_req.take_body_bytes().is_empty(),
+            "borrowed conversion should not copy body bytes"
+        );
+    }
+
+    #[test]
+    fn to_fastly_request_ref_preserves_duplicate_headers() {
+        let http_req = http::Request::builder()
+            .method(http::Method::GET)
+            .uri("https://example.com/")
+            .header("x-custom", "first")
+            .header("x-custom", "second")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let fastly_req = to_fastly_request_ref(&http_req);
+
+        let values: Vec<_> = fastly_req
+            .get_headers()
+            .filter(|(name, _)| name.as_str() == "x-custom")
+            .map(|(_, value)| value.to_str().expect("should be valid utf8"))
+            .collect();
+        assert_eq!(
+            values,
+            vec!["first", "second"],
+            "should preserve duplicate headers"
+        );
+    }
+
     #[test]
     fn sanitize_fastly_forwarded_headers_strips_spoofable() {
         let mut req = fastly::Request::new(fastly::http::Method::GET, "https://example.com");
@@ -391,4 +649,52 @@ mod tests {
             "should set expected expiry cookie"
         );
     }
+
+    #[test]
+    fn to_fastly_request_with_streaming_body_produces_empty_body() {
+        // Stream bodies cannot cross the compat boundary: the Fastly SDK has no
+        // streaming body API, so the shim drops the stream and logs a warning.
+        // This test pins that silent-drop behaviour so it cannot become
+        // accidentally load-bearing.  (Removal target: PR 15.)
+        let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
+            b"data",
+        )]));
+        let http_req = http::Request::builder()
+            .method(http::Method::POST)
+            .uri("https://example.com/")
+            .body(body)
+            .expect("should build request");
+
+        let mut fastly_req = to_fastly_request(http_req);
+
+        assert!(
+            fastly_req.take_body_bytes().is_empty(),
+            "streaming body should be silently dropped; compat shim produces empty body"
+        );
+    }
+
+    #[test]
+    fn to_fastly_response_with_streaming_body_produces_empty_body() {
+        // Same constraint as to_fastly_request: streaming bodies are dropped at
+        // the compat boundary.  (Removal target: PR 15.)
+        let body = EdgeBody::stream(futures::stream::iter(vec![bytes::Bytes::from_static(
+            b"data",
+        )]));
+        let http_resp = http::Response::builder()
+            .status(200)
+            .body(body)
+            .expect("should build response");
+
+        let mut fastly_resp = to_fastly_response(http_resp);
+
+        assert_eq!(
+            fastly_resp.get_status().as_u16(),
+            200,
+            "should copy status code"
+        );
+        assert!(
+            fastly_resp.take_body_bytes().is_empty(),
+            "streaming body should be silently dropped; compat shim produces empty body"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/edge_cookie.rs b/crates/trusted-server-core/src/edge_cookie.rs
index 565d9531..c1b45165 100644
--- a/crates/trusted-server-core/src/edge_cookie.rs
+++ b/crates/trusted-server-core/src/edge_cookie.rs
@@ -5,13 +5,13 @@
 
 use std::net::IpAddr;
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use fastly::Request;
 use hmac::{Hmac, Mac};
+use http::Request;
 use rand::Rng;
 use sha2::Sha256;
 
-use crate::compat;
 use crate::constants::{COOKIE_TS_EC, HEADER_X_TS_EC};
 use crate::cookies::{ec_id_has_only_allowed_chars, handle_request_cookies};
 use crate::error::TrustedServerError;
@@ -108,8 +108,12 @@ pub fn generate_ec_id(
 /// # Errors
 ///
 /// - [`TrustedServerError::InvalidHeaderValue`] if cookie parsing fails
-pub fn get_ec_id(req: &Request) -> Result<Option<String>, Report<TrustedServerError>> {
-    if let Some(ec_id) = req.get_header(HEADER_X_TS_EC).and_then(|h| h.to_str().ok()) {
+pub fn get_ec_id(req: &Request<EdgeBody>) -> Result<Option<String>, Report<TrustedServerError>> {
+    if let Some(ec_id) = req
+        .headers()
+        .get(HEADER_X_TS_EC)
+        .and_then(|h| h.to_str().ok())
+    {
         if ec_id_has_only_allowed_chars(ec_id) {
             log::trace!("Using existing EC ID from header: {}", ec_id);
             return Ok(Some(ec_id.to_string()));
@@ -117,8 +121,7 @@ pub fn get_ec_id(req: &Request) -> Result<Option<String>, Report<TrustedServerEr
         log::warn!("Rejected EC ID from x-ts-ec header with disallowed characters");
     }
 
-    let http_req = compat::from_fastly_headers_ref(req);
-    match handle_request_cookies(&http_req)? {
+    match handle_request_cookies(req)? {
         Some(jar) => {
             if let Some(cookie) = jar.get(COOKIE_TS_EC) {
                 let value = cookie.value();
@@ -151,7 +154,7 @@ pub fn get_ec_id(req: &Request) -> Result<Option<String>, Report<TrustedServerEr
 pub fn get_or_generate_ec_id(
     settings: &Settings,
     services: &RuntimeServices,
-    req: &Request,
+    req: &Request<EdgeBody>,
 ) -> Result<String, Report<TrustedServerError>> {
     if let Some(id) = get_ec_id(req)? {
         return Ok(id);
@@ -166,7 +169,8 @@ pub fn get_or_generate_ec_id(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use fastly::http::{HeaderName, HeaderValue};
+    use edgezero_core::body::Body as EdgeBody;
+    use http::{header, HeaderName};
     use std::net::{Ipv4Addr, Ipv6Addr};
 
     use crate::platform::test_support::{noop_services, noop_services_with_client_ip};
@@ -202,16 +206,14 @@ mod tests {
         assert_eq!(normalize_ip(ipv6_a), "2001:db8:abcd:1::");
     }
 
-    fn create_test_request(headers: Vec<(HeaderName, &str)>) -> Request {
-        let mut req = Request::new("GET", "http://example.com");
+    fn create_test_request(headers: &[(HeaderName, &str)]) -> Request<EdgeBody> {
+        let mut builder = Request::builder().method("GET").uri("http://example.com");
         for (key, value) in headers {
-            req.set_header(
-                key,
-                HeaderValue::from_str(value).expect("should create valid header value"),
-            );
+            builder = builder.header(key, *value);
         }
-
-        req
+        builder
+            .body(EdgeBody::empty())
+            .expect("should build test request")
     }
 
     fn is_ec_id_format(value: &str) -> bool {
@@ -309,7 +311,7 @@ mod tests {
     #[test]
     fn test_get_ec_id_with_header() {
         let settings = create_test_settings();
-        let req = create_test_request(vec![(HEADER_X_TS_EC, "existing_ec_id")]);
+        let req = create_test_request(&[(HEADER_X_TS_EC, "existing_ec_id")]);
 
         let ec_id = get_ec_id(&req).expect("should get EC ID");
         assert_eq!(ec_id, Some("existing_ec_id".to_string()));
@@ -322,8 +324,8 @@ mod tests {
     #[test]
     fn test_get_ec_id_with_cookie() {
         let settings = create_test_settings();
-        let req = create_test_request(vec![(
-            fastly::http::header::COOKIE,
+        let req = create_test_request(&[(
+            header::COOKIE,
             &format!("{}=existing_cookie_id", COOKIE_TS_EC),
         )]);
 
@@ -337,7 +339,7 @@ mod tests {
 
     #[test]
     fn test_get_ec_id_none() {
-        let req = create_test_request(vec![]);
+        let req = create_test_request(&[]);
         let ec_id = get_ec_id(&req).expect("should handle missing ID");
         assert!(ec_id.is_none());
     }
@@ -345,7 +347,7 @@ mod tests {
     #[test]
     fn test_get_or_generate_ec_id_generate_new() {
         let settings = create_test_settings();
-        let req = create_test_request(vec![]);
+        let req = create_test_request(&[]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
             .expect("should get or generate EC ID");
@@ -354,12 +356,9 @@ mod tests {
 
     #[test]
     fn test_get_ec_id_rejects_invalid_header_and_falls_back_to_cookie() {
-        let req = create_test_request(vec![
+        let req = create_test_request(&[
             (HEADER_X_TS_EC, "evil;injected"),
-            (
-                fastly::http::header::COOKIE,
-                &format!("{}=valid_cookie_id", COOKIE_TS_EC),
-            ),
+            (header::COOKIE, &format!("{}=valid_cookie_id", COOKIE_TS_EC)),
         ]);
 
         let ec_id = get_ec_id(&req).expect("should handle invalid header gracefully");
@@ -373,7 +372,7 @@ mod tests {
     #[test]
     fn test_get_or_generate_ec_id_replaces_invalid_header() {
         let settings = create_test_settings();
-        let req = create_test_request(vec![(HEADER_X_TS_EC, "evil;injected")]);
+        let req = create_test_request(&[(HEADER_X_TS_EC, "evil;injected")]);
 
         let ec_id = get_or_generate_ec_id(&settings, &noop_services(), &req)
             .expect("should generate fresh ID on invalid header");
@@ -389,8 +388,8 @@ mod tests {
 
     #[test]
     fn test_get_ec_id_rejects_invalid_cookie() {
-        let req = create_test_request(vec![(
-            fastly::http::header::COOKIE,
+        let req = create_test_request(&[(
+            header::COOKIE,
             &format!("{}=bad<script>value", COOKIE_TS_EC),
         )]);
 
diff --git a/crates/trusted-server-core/src/error.rs b/crates/trusted-server-core/src/error.rs
index 2720e88b..82c66bc9 100644
--- a/crates/trusted-server-core/src/error.rs
+++ b/crates/trusted-server-core/src/error.rs
@@ -45,6 +45,10 @@ pub enum TrustedServerError {
     #[display("Invalid UTF-8 data: {message}")]
     InvalidUtf8 { message: String },
 
+    /// Request payload exceeded maximum allowed size.
+    #[display("Request payload too large: {message}")]
+    RequestTooLarge { message: String },
+
     /// HTTP header value creation failed.
     #[display("Invalid HTTP header value: {message}")]
     InvalidHeaderValue { message: String },
@@ -114,6 +118,7 @@ impl IntoHttpResponse for TrustedServerError {
             Self::Prebid { .. } => StatusCode::BAD_GATEWAY,
             Self::Integration { .. } => StatusCode::BAD_GATEWAY,
             Self::Proxy { .. } => StatusCode::BAD_GATEWAY,
+            Self::RequestTooLarge { .. } => StatusCode::PAYLOAD_TOO_LARGE,
             Self::Forbidden { .. } => StatusCode::FORBIDDEN,
             Self::AllowlistViolation { .. } => StatusCode::FORBIDDEN,
             Self::Ec { .. } => StatusCode::INTERNAL_SERVER_ERROR,
diff --git a/crates/trusted-server-core/src/geo.rs b/crates/trusted-server-core/src/geo.rs
index 3e1e13bc..cf0d8851 100644
--- a/crates/trusted-server-core/src/geo.rs
+++ b/crates/trusted-server-core/src/geo.rs
@@ -1,14 +1,15 @@
 //! Geographic location utilities for the trusted server.
 //!
-//! This module provides Fastly-specific helpers for extracting geographic
-//! information from incoming requests and writing geo headers to responses.
+//! This module provides a Fastly-to-core geo mapping helper and response-header
+//! injection for the platform-neutral [`GeoInfo`] type.
 //!
 //! The [`GeoInfo`] data type is defined in [`crate::platform`] as platform-
-//! neutral data; this module re-exports it and adds Fastly-coupled `impl`
-//! blocks for construction and response header injection.
+//! neutral data; this module re-exports it and adds helper methods for HTTP
+//! response header injection.
 
-use fastly::geo::{geo_lookup, Geo};
-use fastly::{Request, Response};
+use edgezero_core::body::Body as EdgeBody;
+use fastly::geo::Geo;
+use http::{HeaderValue, Response};
 
 pub use crate::platform::GeoInfo;
 
@@ -19,8 +20,8 @@ use crate::constants::{
 
 /// Convert a Fastly [`Geo`] value into a platform-neutral [`GeoInfo`].
 ///
-/// Shared by `GeoInfo::from_request` (legacy) and `FastlyPlatformGeo::lookup` in
-/// `trusted-server-adapter-fastly` so that field mapping is never duplicated.
+/// Shared by `FastlyPlatformGeo::lookup` in `trusted-server-adapter-fastly` so
+/// that field mapping is never duplicated.
 pub fn geo_from_fastly(geo: &Geo) -> GeoInfo {
     GeoInfo {
         city: geo.city().to_string(),
@@ -34,51 +35,44 @@ pub fn geo_from_fastly(geo: &Geo) -> GeoInfo {
 }
 
 impl GeoInfo {
-    /// Creates a new `GeoInfo` from a request by performing a geo lookup.
-    ///
-    /// # Legacy
-    ///
-    /// This is a Fastly-coupled convenience method that predates the
-    /// `platform` abstraction. New code should use
-    /// `RuntimeServices::geo.lookup(client_info.client_ip)` instead, which
-    /// goes through [`crate::platform::PlatformGeo`] and does not require
-    /// direct access to the Fastly request.
-    ///
-    /// # Returns
-    ///
-    /// `Some(GeoInfo)` if geo data is available, `None` otherwise
-    ///
-    /// # Example
-    ///
-    /// ```ignore
-    /// if let Some(geo_info) = GeoInfo::from_request(&req) {
-    ///     println!("User is in {} ({})", geo_info.city, geo_info.country);
-    /// }
-    /// ```
-    #[deprecated(note = "Use RuntimeServices::geo().lookup() instead")]
-    pub fn from_request(req: &Request) -> Option<Self> {
-        req.get_client_ip_addr()
-            .and_then(geo_lookup)
-            .map(|geo| geo_from_fastly(&geo))
-    }
-
     /// Sets geo information headers on the response.
     ///
     /// Adds `x-geo-city`, `x-geo-country`, `x-geo-continent`, `x-geo-coordinates`,
     /// `x-geo-metro-code`, `x-geo-region` (when available), and
     /// `x-geo-info-available: true` to the given response.
-    pub fn set_response_headers(&self, response: &mut Response) {
-        response.set_header(HEADER_X_GEO_CITY, &self.city);
-        response.set_header(HEADER_X_GEO_COUNTRY, &self.country);
-        response.set_header(HEADER_X_GEO_CONTINENT, &self.continent);
-        response.set_header(HEADER_X_GEO_COORDINATES, self.coordinates_string());
+    pub fn set_response_headers(&self, response: &mut Response<EdgeBody>) {
+        let headers = response.headers_mut();
+
+        insert_geo_header(headers, HEADER_X_GEO_CITY, &self.city);
+        insert_geo_header(headers, HEADER_X_GEO_COUNTRY, &self.country);
+        insert_geo_header(headers, HEADER_X_GEO_CONTINENT, &self.continent);
+        insert_geo_header(
+            headers,
+            HEADER_X_GEO_COORDINATES,
+            &self.coordinates_string(),
+        );
         if self.has_metro_code() {
-            response.set_header(HEADER_X_GEO_METRO_CODE, self.metro_code.to_string());
+            let metro_code = self.metro_code.to_string();
+            insert_geo_header(headers, HEADER_X_GEO_METRO_CODE, &metro_code);
         }
         if let Some(ref region) = self.region {
-            response.set_header(HEADER_X_GEO_REGION, region);
+            insert_geo_header(headers, HEADER_X_GEO_REGION, region);
+        }
+        headers.insert(
+            HEADER_X_GEO_INFO_AVAILABLE,
+            HeaderValue::from_static("true"),
+        );
+    }
+}
+
+fn insert_geo_header(headers: &mut http::HeaderMap, name: http::header::HeaderName, value: &str) {
+    match HeaderValue::from_str(value) {
+        Ok(header_value) => {
+            headers.insert(name, header_value);
+        }
+        Err(_) => {
+            log::warn!("Skipping invalid geo header value for {}", name.as_str());
         }
-        response.set_header(HEADER_X_GEO_INFO_AVAILABLE, "true");
     }
 }
 
@@ -118,7 +112,8 @@ pub fn is_gdpr_country(country_code: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
-    use fastly::Response;
+    use edgezero_core::body::Body as EdgeBody;
+    use http::Response as HttpResponse;
 
     fn sample_geo_info() -> GeoInfo {
         GeoInfo {
@@ -132,16 +127,24 @@ mod tests {
         }
     }
 
+    fn build_response() -> HttpResponse<EdgeBody> {
+        HttpResponse::builder()
+            .status(http::StatusCode::OK)
+            .body(EdgeBody::empty())
+            .expect("should build response")
+    }
+
     #[test]
     fn set_response_headers_sets_all_geo_headers() {
         let geo = sample_geo_info();
-        let mut response = Response::new();
+        let mut response = build_response();
 
         geo.set_response_headers(&mut response);
 
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_CITY)
+                .headers()
+                .get(HEADER_X_GEO_CITY)
                 .expect("should have city header")
                 .to_str()
                 .expect("should be valid str"),
@@ -150,7 +153,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_COUNTRY)
+                .headers()
+                .get(HEADER_X_GEO_COUNTRY)
                 .expect("should have country header")
                 .to_str()
                 .expect("should be valid str"),
@@ -159,7 +163,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_CONTINENT)
+                .headers()
+                .get(HEADER_X_GEO_CONTINENT)
                 .expect("should have continent header")
                 .to_str()
                 .expect("should be valid str"),
@@ -168,7 +173,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_COORDINATES)
+                .headers()
+                .get(HEADER_X_GEO_COORDINATES)
                 .expect("should have coordinates header")
                 .to_str()
                 .expect("should be valid str"),
@@ -177,7 +183,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_METRO_CODE)
+                .headers()
+                .get(HEADER_X_GEO_METRO_CODE)
                 .expect("should have metro code header")
                 .to_str()
                 .expect("should be valid str"),
@@ -186,7 +193,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_REGION)
+                .headers()
+                .get(HEADER_X_GEO_REGION)
                 .expect("should have region header")
                 .to_str()
                 .expect("should be valid str"),
@@ -195,7 +203,8 @@ mod tests {
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_INFO_AVAILABLE)
+                .headers()
+                .get(HEADER_X_GEO_INFO_AVAILABLE)
                 .expect("should have info available header")
                 .to_str()
                 .expect("should be valid str"),
@@ -210,16 +219,16 @@ mod tests {
             metro_code: 0,
             ..sample_geo_info()
         };
-        let mut response = Response::new();
+        let mut response = build_response();
 
         geo.set_response_headers(&mut response);
 
         assert!(
-            response.get_header(HEADER_X_GEO_METRO_CODE).is_none(),
+            response.headers().get(HEADER_X_GEO_METRO_CODE).is_none(),
             "should not set metro code header when metro_code is 0"
         );
         assert!(
-            response.get_header(HEADER_X_GEO_CITY).is_some(),
+            response.headers().get(HEADER_X_GEO_CITY).is_some(),
             "should still set city header"
         );
     }
@@ -263,21 +272,22 @@ mod tests {
             region: None,
             ..sample_geo_info()
         };
-        let mut response = Response::new();
+        let mut response = build_response();
 
         geo.set_response_headers(&mut response);
 
         assert!(
-            response.get_header(HEADER_X_GEO_REGION).is_none(),
+            response.headers().get(HEADER_X_GEO_REGION).is_none(),
             "should not set region header when region is None"
         );
         assert!(
-            response.get_header(HEADER_X_GEO_CITY).is_some(),
+            response.headers().get(HEADER_X_GEO_CITY).is_some(),
             "should still set city header"
         );
         assert_eq!(
             response
-                .get_header(HEADER_X_GEO_INFO_AVAILABLE)
+                .headers()
+                .get(HEADER_X_GEO_INFO_AVAILABLE)
                 .expect("should have info available header")
                 .to_str()
                 .expect("should be valid str"),
diff --git a/crates/trusted-server-core/src/integrations/google_tag_manager.rs b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
index 8c054245..c63355b8 100644
--- a/crates/trusted-server-core/src/integrations/google_tag_manager.rs
+++ b/crates/trusted-server-core/src/integrations/google_tag_manager.rs
@@ -22,6 +22,7 @@ use regex::Regex;
 use serde::{Deserialize, Serialize};
 use validator::Validate;
 
+use crate::compat;
 use crate::error::TrustedServerError;
 use crate::integrations::{
     AttributeRewriteAction, IntegrationAttributeContext, IntegrationAttributeRewriter,
@@ -484,9 +485,16 @@ impl IntegrationProxy for GoogleTagManagerIntegration {
             }
         };
 
-        let mut response = proxy_request(settings, req, proxy_config, services)
+        let mut response = compat::to_fastly_response(
+            proxy_request(
+                settings,
+                compat::from_fastly_request(req),
+                proxy_config,
+                services,
+            )
             .await
-            .change_context(Self::error("Failed to proxy GTM request"))?;
+            .change_context(Self::error("Failed to proxy GTM request"))?,
+        );
 
         // If we are serving gtm.js or gtag.js, rewrite internal URLs to route beacons through us.
         if self.is_rewritable_script(&path) {
diff --git a/crates/trusted-server-core/src/integrations/gpt.rs b/crates/trusted-server-core/src/integrations/gpt.rs
index 40bcf7f2..d86d98d6 100644
--- a/crates/trusted-server-core/src/integrations/gpt.rs
+++ b/crates/trusted-server-core/src/integrations/gpt.rs
@@ -42,6 +42,7 @@ use serde::{Deserialize, Serialize};
 use url::Url;
 use validator::Validate;
 
+use crate::compat;
 use crate::constants::{HEADER_ACCEPT, HEADER_ACCEPT_ENCODING, HEADER_ACCEPT_LANGUAGE};
 use crate::error::TrustedServerError;
 use crate::integrations::{
@@ -245,9 +246,11 @@ impl GptIntegration {
         context: &str,
     ) -> Result<Response, Report<TrustedServerError>> {
         let config = Self::build_proxy_config(target_url, &req);
-        let response = proxy_request(settings, req, config, services)
-            .await
-            .change_context(Self::error(context))?;
+        let response = compat::to_fastly_response(
+            proxy_request(settings, compat::from_fastly_request(req), config, services)
+                .await
+                .change_context(Self::error(context))?,
+        );
 
         Self::ensure_successful_gpt_asset_response(&response, context)?;
         Ok(self.finalize_gpt_asset_response(response))
diff --git a/crates/trusted-server-core/src/integrations/registry.rs b/crates/trusted-server-core/src/integrations/registry.rs
index c7b2595a..58f042aa 100644
--- a/crates/trusted-server-core/src/integrations/registry.rs
+++ b/crates/trusted-server-core/src/integrations/registry.rs
@@ -666,7 +666,8 @@ impl IntegrationRegistry {
     ) -> Option<Result<Response, Report<TrustedServerError>>> {
         if let Some((proxy, _)) = self.find_route(method, path) {
             // Generate EC ID before consuming request
-            let ec_id_result = get_or_generate_ec_id(settings, services, &req);
+            let http_req = compat::from_fastly_headers_ref(&req);
+            let ec_id_result = get_or_generate_ec_id(settings, services, &http_req);
 
             // Set EC ID header on the request so integrations can read it.
             // Header injection: Fastly's HeaderValue API rejects values containing \r, \n, or \0,
diff --git a/crates/trusted-server-core/src/integrations/testlight.rs b/crates/trusted-server-core/src/integrations/testlight.rs
index 657294fa..5507ad12 100644
--- a/crates/trusted-server-core/src/integrations/testlight.rs
+++ b/crates/trusted-server-core/src/integrations/testlight.rs
@@ -8,6 +8,7 @@ use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value};
 use validator::Validate;
 
+use crate::compat;
 use crate::edge_cookie::get_ec_id;
 use crate::error::TrustedServerError;
 use crate::integrations::{
@@ -151,7 +152,8 @@ impl IntegrationProxy for TestlightIntegration {
             .map_err(|err| Report::new(Self::error(format!("Invalid request payload: {err}"))))?;
 
         // Read EC ID from header (set by registry) or cookie
-        let ec_id = get_ec_id(&req)
+        let http_req = compat::from_fastly_headers_ref(&req);
+        let ec_id = get_ec_id(&http_req)
             .change_context(Self::error("Failed to read EC ID"))?
             .ok_or_else(|| {
                 Report::new(Self::error(
@@ -174,9 +176,16 @@ impl IntegrationProxy for TestlightIntegration {
             HeaderValue::from_static("application/json"),
         ));
 
-        let mut response = proxy_request(settings, req, proxy_config, services)
+        let mut response = compat::to_fastly_response(
+            proxy_request(
+                settings,
+                compat::from_fastly_request(req),
+                proxy_config,
+                services,
+            )
             .await
-            .change_context(Self::error("Failed to contact upstream integration"))?;
+            .change_context(Self::error("Failed to contact upstream integration"))?,
+        );
 
         // Attempt to parse response into structured form for logging/future transforms.
         let response_body = response.take_body_bytes();
diff --git a/crates/trusted-server-core/src/migration_guards.rs b/crates/trusted-server-core/src/migration_guards.rs
index f23fe651..7cfa8d0e 100644
--- a/crates/trusted-server-core/src/migration_guards.rs
+++ b/crates/trusted-server-core/src/migration_guards.rs
@@ -23,32 +23,38 @@ fn strip_line_comments(source: &str) -> String {
 }
 
 #[test]
-fn migrated_utility_modules_do_not_depend_on_fastly_request_response_types() {
+fn migrated_utility_and_handler_modules_do_not_depend_on_fastly_request_response_types() {
     let sources = [
         ("auth.rs", include_str!("auth.rs")),
         ("cookies.rs", include_str!("cookies.rs")),
         ("http_util.rs", include_str!("http_util.rs")),
+        ("geo.rs", include_str!("geo.rs")),
+        ("publisher.rs", include_str!("publisher.rs")),
+        ("proxy.rs", include_str!("proxy.rs")),
+        ("auction/formats.rs", include_str!("auction/formats.rs")),
+        ("auction/endpoints.rs", include_str!("auction/endpoints.rs")),
+        (
+            "request_signing/endpoints.rs",
+            include_str!("request_signing/endpoints.rs"),
+        ),
         (
             "consent/extraction.rs",
             include_str!("consent/extraction.rs"),
         ),
         ("consent/mod.rs", include_str!("consent/mod.rs")),
     ];
-    let banned_patterns = [
-        "fastly::Request",
-        "fastly::Response",
-        "fastly::http::Method",
-        "fastly::http::StatusCode",
-        "fastly::mime::APPLICATION_JSON",
-    ];
+    // Word-boundary regex prevents false positives from doc comments or string
+    // literals that merely mention Fastly type names without importing them.
+    let banned = regex::Regex::new(
+        r"\bfastly::(Request|Response|http::(Method|StatusCode)|mime::APPLICATION_JSON)\b",
+    )
+    .expect("should compile migration guard regex");
 
     for (path, source) in sources {
         let uncommented = strip_line_comments(source);
-        for banned in banned_patterns {
-            assert!(
-                !uncommented.contains(banned),
-                "{path} should not reference `{banned}` after PR11 migration"
-            );
-        }
+        assert!(
+            !banned.is_match(&uncommented),
+            "{path} should not reference fastly Request/Response types after PR11 migration"
+        );
     }
 }
diff --git a/crates/trusted-server-core/src/proxy.rs b/crates/trusted-server-core/src/proxy.rs
index d1da3aa7..c456cfb2 100644
--- a/crates/trusted-server-core/src/proxy.rs
+++ b/crates/trusted-server-core/src/proxy.rs
@@ -3,9 +3,9 @@ use crate::http_util::{compute_encrypted_sha256_token, ct_str_eq};
 use edgezero_core::body::Body as EdgeBody;
 use edgezero_core::http::{request_builder as edge_request_builder, Uri as EdgeUri};
 use error_stack::{Report, ResultExt};
-use fastly::http::{header, HeaderValue, Method, StatusCode};
-use fastly::{Request, Response};
+use http::{header, HeaderValue, Method, Request, Response, StatusCode};
 use serde::{Deserialize, Serialize};
+use std::io::Cursor;
 use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use crate::constants::{
@@ -15,15 +15,20 @@ use crate::constants::{
 use crate::creative::{CreativeCssProcessor, CreativeHtmlProcessor};
 use crate::edge_cookie::get_ec_id;
 use crate::error::TrustedServerError;
-use crate::platform::{
-    PlatformBackendSpec, PlatformHttpRequest, PlatformResponse, RuntimeServices,
-};
+use crate::platform::{PlatformBackendSpec, PlatformHttpRequest, RuntimeServices};
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
 
 /// Chunk size used for streaming content through the rewrite pipeline.
 const STREAMING_CHUNK_SIZE: usize = 8192;
 
+const SIGN_MAX_BODY_BYTES: usize = 65536;
+const REBUILD_MAX_BODY_BYTES: usize = 65536;
+
+fn body_as_reader(body: EdgeBody) -> Cursor<bytes::Bytes> {
+    Cursor::new(body.into_bytes())
+}
+
 /// Headers copied from the original client request to the upstream proxy request
 /// when `copy_request_headers` is enabled.
 ///
@@ -39,36 +44,6 @@ const PROXY_FORWARD_HEADERS: [header::HeaderName; 5] = [
     HEADER_X_FORWARDED_FOR,
 ];
 
-/// Convert a platform-neutral response into a [`fastly::Response`] for downstream processing.
-///
-/// Shared with `auction/orchestrator.rs`. Both files will migrate off `fastly::Response`
-/// entirely in Phase 2, at which point this conversion helper will be removed.
-///
-/// # Errors
-///
-/// Returns [`TrustedServerError::Proxy`] when `platform_resp` carries a
-/// streaming body, which this Fastly-only conversion path cannot materialize.
-pub(crate) fn platform_response_to_fastly(
-    platform_resp: PlatformResponse,
-) -> Result<Response, Report<TrustedServerError>> {
-    let (parts, body) = platform_resp.response.into_parts();
-    let body_bytes = match body {
-        EdgeBody::Once(bytes) => bytes.to_vec(),
-        EdgeBody::Stream(_) => {
-            return Err(Report::new(TrustedServerError::Proxy {
-                message: "streaming platform response body is not supported by Fastly response conversion"
-                    .to_string(),
-            }));
-        }
-    };
-    let mut resp = Response::from_status(parts.status.as_u16());
-    for (name, value) in parts.headers.iter() {
-        resp.append_header(name.as_str(), value.as_bytes());
-    }
-    resp.set_body(body_bytes);
-    Ok(resp)
-}
-
 #[derive(Deserialize)]
 struct ProxySignReq {
     url: String,
@@ -158,31 +133,27 @@ const SUPPORTED_ENCODINGS: &str = "gzip, deflate, br";
 /// If `preserve_encoding` is true, the Content-Encoding header is kept (for compressed responses).
 /// If false, Content-Encoding is stripped (for decompressed responses).
 fn rebuild_response_with_body(
-    beresp: &Response,
+    beresp: Response<EdgeBody>,
     content_type: &'static str,
     body: Vec<u8>,
     preserve_encoding: bool,
-) -> Response {
-    let status = beresp.get_status();
-    let headers: Vec<(header::HeaderName, HeaderValue)> = beresp
-        .get_headers()
-        .map(|(name, value)| (name.clone(), value.clone()))
-        .collect();
-    let mut resp = Response::from_status(status);
-    for (name, value) in headers {
-        // Always skip Content-Length (size changed) and Content-Type (we set it)
-        if name == header::CONTENT_LENGTH || name == header::CONTENT_TYPE {
-            continue;
-        }
-        // Skip Content-Encoding only if we're not preserving it
-        if name == header::CONTENT_ENCODING && !preserve_encoding {
-            continue;
-        }
-        resp.append_header(name, value);
+) -> Response<EdgeBody> {
+    let (mut parts, _) = beresp.into_parts();
+
+    // Always skip Content-Length (size changed) and Content-Type (we set it)
+    parts.headers.remove(header::CONTENT_LENGTH);
+    parts.headers.remove(header::CONTENT_TYPE);
+
+    // Skip Content-Encoding only if we're not preserving it
+    if !preserve_encoding {
+        parts.headers.remove(header::CONTENT_ENCODING);
     }
-    resp.set_header(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
-    resp.set_body(body);
-    resp
+
+    parts
+        .headers
+        .insert(header::CONTENT_TYPE, HeaderValue::from_static(content_type));
+
+    Response::from_parts(parts, EdgeBody::from(body))
 }
 
 /// Process a response body through a streaming pipeline with the given processor.
@@ -190,29 +161,29 @@ fn rebuild_response_with_body(
 /// Handles decompression, content processing, and re-compression while preserving
 /// the response status and headers.
 fn process_response_with_pipeline<P: StreamProcessor>(
-    mut beresp: Response,
+    mut beresp: Response<EdgeBody>,
     processor: P,
     compression: Compression,
     content_type: &'static str,
     error_context: &'static str,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let config = PipelineConfig {
         input_compression: compression,
         output_compression: compression,
         chunk_size: STREAMING_CHUNK_SIZE,
     };
 
-    let body = beresp.take_body();
+    let body = std::mem::replace(beresp.body_mut(), EdgeBody::empty());
     let mut output = Vec::new();
     let mut pipeline = StreamingPipeline::new(config, processor);
     pipeline
-        .process(body, &mut output)
+        .process(body_as_reader(body), &mut output)
         .change_context(TrustedServerError::Proxy {
             message: error_context.to_string(),
         })?;
 
     Ok(rebuild_response_with_body(
-        &beresp,
+        beresp,
         content_type,
         output,
         compression != Compression::None,
@@ -221,28 +192,32 @@ fn process_response_with_pipeline<P: StreamProcessor>(
 
 fn finalize_proxied_response(
     settings: &Settings,
-    req: &Request,
+    req: &Request<EdgeBody>,
     target_url: &str,
-    mut beresp: Response,
-) -> Result<Response, Report<TrustedServerError>> {
+    mut beresp: Response<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // Determine content-type and content-encoding from response headers
-    let status_code = beresp.get_status().as_u16();
+    let status_code = beresp.status().as_u16();
     let ct_raw = beresp
-        .get_header(header::CONTENT_TYPE)
+        .headers()
+        .get(header::CONTENT_TYPE)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("")
         .to_string();
     let content_encoding = beresp
-        .get_header(header::CONTENT_ENCODING)
+        .headers()
+        .get(header::CONTENT_ENCODING)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("")
         .to_string();
     let cl_raw = beresp
-        .get_header(header::CONTENT_LENGTH)
+        .headers()
+        .get(header::CONTENT_LENGTH)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("-");
     let accept_raw = req
-        .get_header(HEADER_ACCEPT)
+        .headers()
+        .get(HEADER_ACCEPT)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("-");
 
@@ -289,20 +264,24 @@ fn finalize_proxied_response(
 
     // Image handling: set generic content-type if missing and log pixel heuristics
     let req_accept_images = req
-        .get_header(HEADER_ACCEPT)
+        .headers()
+        .get(HEADER_ACCEPT)
         .and_then(|h| h.to_str().ok())
         .map(|s| s.to_ascii_lowercase().contains("image/"))
         .unwrap_or(false);
 
     if ct.starts_with("image/") || req_accept_images {
-        if beresp.get_header(header::CONTENT_TYPE).is_none() {
-            beresp.set_header(header::CONTENT_TYPE, "image/*");
+        if beresp.headers().get(header::CONTENT_TYPE).is_none() {
+            beresp
+                .headers_mut()
+                .insert(header::CONTENT_TYPE, HeaderValue::from_static("image/*"));
         }
 
         // Heuristics to log likely tracking pixels without altering response
         let mut is_pixel = false;
         if let Some(cl) = beresp
-            .get_header(header::CONTENT_LENGTH)
+            .headers()
+            .get(header::CONTENT_LENGTH)
             .and_then(|h| h.to_str().ok())
             .and_then(|s| s.parse::<u64>().ok())
         {
@@ -336,22 +315,25 @@ fn finalize_proxied_response(
 }
 
 fn finalize_proxied_response_streaming(
-    req: &Request,
+    req: &Request<EdgeBody>,
     target_url: &str,
-    mut beresp: Response,
-) -> Response {
-    let status_code = beresp.get_status().as_u16();
+    mut beresp: Response<EdgeBody>,
+) -> Response<EdgeBody> {
+    let status_code = beresp.status().as_u16();
     let ct_raw = beresp
-        .get_header(header::CONTENT_TYPE)
+        .headers()
+        .get(header::CONTENT_TYPE)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("")
         .to_string();
     let cl_raw = beresp
-        .get_header(header::CONTENT_LENGTH)
+        .headers()
+        .get(header::CONTENT_LENGTH)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("-");
     let accept_raw = req
-        .get_header(HEADER_ACCEPT)
+        .headers()
+        .get(HEADER_ACCEPT)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("-");
 
@@ -368,19 +350,23 @@ fn finalize_proxied_response_streaming(
     let ct = ct_raw.to_ascii_lowercase();
 
     let req_accept_images = req
-        .get_header(HEADER_ACCEPT)
+        .headers()
+        .get(HEADER_ACCEPT)
         .and_then(|h| h.to_str().ok())
         .map(|s| s.to_ascii_lowercase().contains("image/"))
         .unwrap_or(false);
 
     if ct.starts_with("image/") || req_accept_images {
-        if beresp.get_header(header::CONTENT_TYPE).is_none() {
-            beresp.set_header(header::CONTENT_TYPE, "image/*");
+        if beresp.headers().get(header::CONTENT_TYPE).is_none() {
+            beresp
+                .headers_mut()
+                .insert(header::CONTENT_TYPE, HeaderValue::from_static("image/*"));
         }
 
         let mut is_pixel = false;
         if let Some(cl) = beresp
-            .get_header(header::CONTENT_LENGTH)
+            .headers()
+            .get(header::CONTENT_LENGTH)
             .and_then(|h| h.to_str().ok())
             .and_then(|s| s.parse::<u64>().ok())
         {
@@ -416,11 +402,11 @@ fn finalize_proxied_response_streaming(
 /// content processing based on the `stream_passthrough` flag.
 fn finalize_response(
     settings: &Settings,
-    req: &Request,
+    req: &Request<EdgeBody>,
     url: &str,
-    beresp: Response,
+    beresp: Response<EdgeBody>,
     stream_passthrough: bool,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     if stream_passthrough {
         Ok(finalize_proxied_response_streaming(req, url, beresp))
     } else {
@@ -452,10 +438,10 @@ struct ProxyRequestHeaders<'a> {
 ///   scheme, lacks a host, or the upstream fetch fails
 pub async fn proxy_request(
     settings: &Settings,
-    req: Request,
+    req: Request<EdgeBody>,
     config: ProxyRequestConfig<'_>,
     services: &RuntimeServices,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let ProxyRequestConfig {
         target_url,
         follow_redirects,
@@ -512,7 +498,7 @@ fn upsert_ec_query_param(url: &mut url::Url, ec_id: &str) {
     url.set_query(Some(&serializer.finish()));
 }
 
-fn append_ec_id(req: &Request, target_url_parsed: &mut url::Url) {
+fn append_ec_id(req: &Request<EdgeBody>, target_url_parsed: &mut url::Url) {
     let ec_id_param = match get_ec_id(req) {
         Ok(id) => id,
         Err(e) => {
@@ -566,17 +552,17 @@ fn is_host_allowed(host: &str, pattern: &str) -> bool {
 
 async fn proxy_with_redirects(
     settings: &Settings,
-    req: &Request,
+    req: &Request<EdgeBody>,
     target_url_parsed: url::Url,
     follow_redirects: bool,
     body: Option<&[u8]>,
     request_headers: ProxyRequestHeaders<'_>,
     stream_passthrough: bool,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     const MAX_REDIRECTS: usize = 4;
 
     let mut current_url = target_url_parsed.to_string();
-    let mut current_method: Method = req.get_method().clone();
+    let mut current_method: Method = req.method().clone();
 
     for redirect_attempt in 0..=MAX_REDIRECTS {
         let parsed_url = url::Url::parse(&current_url).map_err(|_| {
@@ -636,7 +622,7 @@ async fn proxy_with_redirects(
         let mut outbound_headers = http::HeaderMap::new();
         if request_headers.copy_request_headers {
             for header_name in PROXY_FORWARD_HEADERS {
-                if let Some(v) = req.get_header(&header_name) {
+                if let Some(v) = req.headers().get(&header_name) {
                     outbound_headers.insert(header_name, v.clone());
                 }
             }
@@ -669,13 +655,13 @@ async fn proxy_with_redirects(
                 message: "Failed to proxy".to_string(),
             })?;
 
-        let beresp = platform_response_to_fastly(platform_resp)?;
+        let beresp = platform_resp.response;
 
         if !follow_redirects {
             return finalize_response(settings, req, &current_url, beresp, stream_passthrough);
         }
 
-        let status = beresp.get_status();
+        let status = beresp.status();
         let is_redirect = matches!(
             status,
             StatusCode::MOVED_PERMANENTLY
@@ -690,7 +676,8 @@ async fn proxy_with_redirects(
         }
 
         let Some(location) = beresp
-            .get_header(header::LOCATION)
+            .headers()
+            .get(header::LOCATION)
             .and_then(|h| h.to_str().ok())
             .filter(|value| !value.is_empty())
         else {
@@ -773,11 +760,11 @@ async fn proxy_with_redirects(
 pub async fn handle_first_party_proxy(
     settings: &Settings,
     services: &RuntimeServices,
-    req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     // Parse, reconstruct, and validate the signed target URL
     let SignedTarget { target_url, .. } =
-        reconstruct_and_validate_signed_target(settings, req.get_url_str())?;
+        reconstruct_and_validate_signed_target(settings, &req.uri().to_string())?;
 
     proxy_request(
         settings,
@@ -810,13 +797,13 @@ pub async fn handle_first_party_proxy(
 pub async fn handle_first_party_click(
     settings: &Settings,
     _services: &RuntimeServices,
-    req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let SignedTarget {
         target_url: full_for_token,
         tsurl,
         had_params,
-    } = reconstruct_and_validate_signed_target(settings, req.get_url_str())?;
+    } = reconstruct_and_validate_signed_target(settings, &req.uri().to_string())?;
 
     let ec_id = match get_ec_id(&req) {
         Ok(id) => id,
@@ -842,11 +829,13 @@ pub async fn handle_first_party_click(
 
     // Log click metadata for observability
     let ua = req
-        .get_header(HEADER_USER_AGENT)
+        .headers()
+        .get(HEADER_USER_AGENT)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("");
     let referer = req
-        .get_header(HEADER_REFERER)
+        .headers()
+        .get(HEADER_REFERER)
         .and_then(|h| h.to_str().ok())
         .unwrap_or("");
     log::info!(
@@ -860,9 +849,19 @@ pub async fn handle_first_party_click(
     );
 
     // 302 redirect to target URL
-    Ok(Response::from_status(fastly::http::StatusCode::FOUND)
-        .with_header(header::LOCATION, &redirect_target)
-        .with_header(header::CACHE_CONTROL, "no-store, private"))
+    let location = HeaderValue::from_str(&redirect_target).map_err(|_| {
+        Report::new(TrustedServerError::InvalidHeaderValue {
+            message: "invalid redirect target".to_string(),
+        })
+    })?;
+    let mut response = Response::new(EdgeBody::empty());
+    *response.status_mut() = StatusCode::FOUND;
+    response.headers_mut().insert(header::LOCATION, location);
+    response.headers_mut().insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("no-store, private"),
+    );
+    Ok(response)
 }
 
 /// Sign an arbitrary asset URL so creatives can request first-party proxying at runtime.
@@ -877,20 +876,33 @@ pub async fn handle_first_party_click(
 pub async fn handle_first_party_proxy_sign(
     settings: &Settings,
     _services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
-    let method = req.get_method().clone();
-
-    let payload = if method == fastly::http::Method::POST {
-        let body = req.take_body_str();
-        serde_json::from_str::<ProxySignReq>(&body).change_context(TrustedServerError::Proxy {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    let method = req.method().clone();
+    let req_url = req.uri().to_string();
+
+    let payload = if method == Method::POST {
+        let body_bytes = req.into_body().into_bytes();
+        if body_bytes.len() > SIGN_MAX_BODY_BYTES {
+            return Err(Report::new(TrustedServerError::RequestTooLarge {
+                message: format!(
+                    "payload size {} exceeds limit of {} bytes",
+                    body_bytes.len(),
+                    SIGN_MAX_BODY_BYTES,
+                ),
+            }));
+        }
+        let body =
+            std::str::from_utf8(&body_bytes).change_context(TrustedServerError::InvalidUtf8 {
+                message: "first-party sign request body should be valid UTF-8".to_string(),
+            })?;
+        serde_json::from_str::<ProxySignReq>(body).change_context(TrustedServerError::Proxy {
             message: "invalid JSON".to_string(),
         })?
     } else {
-        let parsed =
-            url::Url::parse(req.get_url_str()).change_context(TrustedServerError::Proxy {
-                message: "Invalid URL".to_string(),
-            })?;
+        let parsed = url::Url::parse(&req_url).change_context(TrustedServerError::Proxy {
+            message: "Invalid URL".to_string(),
+        })?;
         let url = parsed
             .query_pairs()
             .find(|(k, _)| k == "url")
@@ -905,7 +917,7 @@ pub async fn handle_first_party_proxy_sign(
 
     let trimmed = payload.url.trim();
     let abs = if trimmed.starts_with("//") {
-        let default_scheme = url::Url::parse(req.get_url_str())
+        let default_scheme = url::Url::parse(&req_url)
             .ok()
             .map(|u| u.scheme().to_ascii_lowercase())
             .filter(|scheme| !scheme.is_empty())
@@ -948,12 +960,15 @@ pub async fn handle_first_party_proxy_sign(
         base: base.to_string(),
     };
 
-    let mut response = Response::from_status(fastly::http::StatusCode::OK);
-    response.set_header(header::CONTENT_TYPE, "application/json; charset=utf-8");
-    response.set_body(
+    let mut response = Response::new(EdgeBody::from(
         serde_json::to_string(&resp).change_context(TrustedServerError::Proxy {
             message: "failed to serialize".to_string(),
         })?,
+    ));
+    *response.status_mut() = StatusCode::OK;
+    response.headers_mut().insert(
+        header::CONTENT_TYPE,
+        HeaderValue::from_static("application/json; charset=utf-8"),
     );
     Ok(response)
 }
@@ -985,22 +1000,33 @@ struct ProxyRebuildResp {
 pub async fn handle_first_party_proxy_rebuild(
     settings: &Settings,
     _services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
-    let method = req.get_method().clone();
-    let payload = if method == fastly::http::Method::POST {
-        let body = req.take_body_str();
-        serde_json::from_str::<ProxyRebuildReq>(&body).change_context(
-            TrustedServerError::Proxy {
-                message: "invalid JSON".to_string(),
-            },
-        )?
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    let method = req.method().clone();
+    let req_url = req.uri().to_string();
+    let payload = if method == Method::POST {
+        let body_bytes = req.into_body().into_bytes();
+        if body_bytes.len() > REBUILD_MAX_BODY_BYTES {
+            return Err(Report::new(TrustedServerError::RequestTooLarge {
+                message: format!(
+                    "payload size {} exceeds limit of {} bytes",
+                    body_bytes.len(),
+                    REBUILD_MAX_BODY_BYTES,
+                ),
+            }));
+        }
+        let body =
+            std::str::from_utf8(&body_bytes).change_context(TrustedServerError::InvalidUtf8 {
+                message: "first-party rebuild request body should be valid UTF-8".to_string(),
+            })?;
+        serde_json::from_str::<ProxyRebuildReq>(body).change_context(TrustedServerError::Proxy {
+            message: "invalid JSON".to_string(),
+        })?
     } else {
         // Support GET: /first-party/proxy-rebuild?tsclick=...&add=...&del=...
-        let parsed =
-            url::Url::parse(req.get_url_str()).change_context(TrustedServerError::Proxy {
-                message: "Invalid URL".to_string(),
-            })?;
+        let parsed = url::Url::parse(&req_url).change_context(TrustedServerError::Proxy {
+            message: "Invalid URL".to_string(),
+        })?;
         let mut tsclick: Option<String> = None;
         let mut add: Option<std::collections::HashMap<String, String>> = None;
         let mut del: Option<Vec<String>> = None;
@@ -1117,11 +1143,21 @@ pub async fn handle_first_party_proxy_rebuild(
         }
     }
 
-    if method == fastly::http::Method::GET {
+    if method == Method::GET {
         // Redirect for GET usage to streamline navigation
-        Ok(Response::from_status(fastly::http::StatusCode::FOUND)
-            .with_header(header::LOCATION, href)
-            .with_header(header::CACHE_CONTROL, "no-store, private"))
+        let location = HeaderValue::from_str(&href).map_err(|_| {
+            Report::new(TrustedServerError::InvalidHeaderValue {
+                message: "invalid rebuild redirect target".to_string(),
+            })
+        })?;
+        let mut response = Response::new(EdgeBody::empty());
+        *response.status_mut() = StatusCode::FOUND;
+        response.headers_mut().insert(header::LOCATION, location);
+        response.headers_mut().insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("no-store, private"),
+        );
+        Ok(response)
     } else {
         let json = serde_json::to_string(&ProxyRebuildResp {
             href,
@@ -1129,11 +1165,20 @@ pub async fn handle_first_party_proxy_rebuild(
             added,
             removed,
         })
-        .unwrap_or_else(|_| "{}".to_string());
-        Ok(Response::from_status(fastly::http::StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "application/json; charset=utf-8")
-            .with_header(header::CACHE_CONTROL, "no-store, private")
-            .with_body(json))
+        .change_context(TrustedServerError::Proxy {
+            message: "failed to serialize rebuild response".to_string(),
+        })?;
+        let mut response = Response::new(EdgeBody::from(json));
+        *response.status_mut() = StatusCode::OK;
+        response.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/json; charset=utf-8"),
+        );
+        response.headers_mut().insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("no-store, private"),
+        );
+        Ok(response)
     }
 }
 
@@ -1268,8 +1313,79 @@ mod tests {
     use edgezero_core::body::Body as EdgeBody;
     use edgezero_core::http::response_builder as edge_response_builder;
     use error_stack::Report;
-    use fastly::http::{header, HeaderValue, Method, StatusCode};
-    use fastly::{Request, Response};
+    use http::{header, HeaderValue, Method, Request as HttpRequest, Response, StatusCode};
+
+    #[test]
+    fn test_rebuild_response_with_body_preserves_multiple_headers() {
+        let mut response = Response::new(EdgeBody::empty());
+        response
+            .headers_mut()
+            .append(header::SET_COOKIE, HeaderValue::from_static("session=123"));
+        response
+            .headers_mut()
+            .append(header::SET_COOKIE, HeaderValue::from_static("tracker=456"));
+        response
+            .headers_mut()
+            .insert(header::CONTENT_TYPE, HeaderValue::from_static("text/html"));
+
+        let rebuilt =
+            rebuild_response_with_body(response, "application/json", b"{}".to_vec(), false);
+
+        let cookies: Vec<_> = rebuilt
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|h| h.to_str().ok())
+            .collect();
+        assert_eq!(cookies, vec!["session=123", "tracker=456"]);
+        assert_eq!(
+            rebuilt
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .unwrap()
+                .to_str()
+                .unwrap(),
+            "application/json"
+        );
+    }
+
+    fn build_http_request(method: Method, uri: impl AsRef<str>) -> HttpRequest<EdgeBody> {
+        HttpRequest::builder()
+            .method(method)
+            .uri(uri.as_ref())
+            .body(EdgeBody::empty())
+            .expect("should build http request")
+    }
+
+    fn build_http_post_json_request(
+        uri: impl AsRef<str>,
+        body: &serde_json::Value,
+    ) -> HttpRequest<EdgeBody> {
+        HttpRequest::builder()
+            .method(Method::POST)
+            .uri(uri.as_ref())
+            .header(http::header::CONTENT_TYPE, "application/json")
+            .body(EdgeBody::from(body.to_string()))
+            .expect("should build http post request")
+    }
+
+    fn response_body_string(response: http::Response<EdgeBody>) -> String {
+        String::from_utf8(response.into_body().into_bytes().to_vec())
+            .expect("response body should be valid UTF-8")
+    }
+
+    fn build_http_response(status: StatusCode, body: EdgeBody) -> Response<EdgeBody> {
+        let mut response = Response::new(body);
+        *response.status_mut() = status;
+        response
+    }
+
+    fn response_header(response: &Response<EdgeBody>, name: header::HeaderName) -> Option<&str> {
+        response
+            .headers()
+            .get(name)
+            .and_then(|value| value.to_str().ok())
+    }
 
     /// Test double that always returns a streaming (non-buffered) response body.
     ///
@@ -1313,7 +1429,7 @@ mod tests {
     #[tokio::test]
     async fn proxy_missing_param_returns_400() {
         let settings = create_test_settings();
-        let req = Request::new(Method::GET, "https://example.com/first-party/proxy");
+        let req = build_http_request(Method::GET, "https://example.com/first-party/proxy");
         let err: Report<TrustedServerError> =
             handle_first_party_proxy(&settings, &noop_services(), req)
                 .await
@@ -1325,7 +1441,7 @@ mod tests {
     async fn proxy_missing_or_invalid_token_returns_400() {
         let settings = create_test_settings();
         // missing tstoken should 400
-        let req = Request::new(
+        let req = build_http_request(
             Method::GET,
             "https://example.com/first-party/proxy?tsurl=https%3A%2F%2Fcdn.example%2Fa.png",
         );
@@ -1342,13 +1458,12 @@ mod tests {
         let body = serde_json::json!({
             "url": "https://cdn.example/asset.js?c=3&b=2",
         });
-        let mut req = Request::new(Method::POST, "https://edge.example/first-party/sign");
-        req.set_body(body.to_string());
-        let mut resp = handle_first_party_proxy_sign(&settings, &noop_services(), req)
+        let req = build_http_post_json_request("https://edge.example/first-party/sign", &body);
+        let resp = handle_first_party_proxy_sign(&settings, &noop_services(), req)
             .await
             .expect("sign ok");
-        assert_eq!(resp.get_status(), StatusCode::OK);
-        let json = resp.take_body_str();
+        assert_eq!(resp.status(), StatusCode::OK);
+        let json = response_body_string(resp);
         assert!(json.contains("/first-party/proxy?tsurl="), "{}", json);
         assert!(json.contains("tsexp"), "{}", json);
         assert!(
@@ -1364,8 +1479,7 @@ mod tests {
         let body = serde_json::json!({
             "url": "data:image/png;base64,AAAA",
         });
-        let mut req = Request::new(Method::POST, "https://edge.example/first-party/sign");
-        req.set_body(body.to_string());
+        let req = build_http_post_json_request("https://edge.example/first-party/sign", &body);
         let err: Report<TrustedServerError> =
             handle_first_party_proxy_sign(&settings, &noop_services(), req)
                 .await
@@ -1379,17 +1493,12 @@ mod tests {
         let body = serde_json::json!({
             "url": "https://cdn.example.com:9443/img/300x250.svg",
         });
-        let mut req = Request::new(Method::POST, "https://edge.example/first-party/sign");
-        req.set_body(body.to_string());
-        let mut resp = handle_first_party_proxy_sign(&settings, &noop_services(), req)
+        let req = build_http_post_json_request("https://edge.example/first-party/sign", &body);
+        let resp = handle_first_party_proxy_sign(&settings, &noop_services(), req)
             .await
             .expect("should sign URL with non-standard port");
-        assert_eq!(
-            resp.get_status(),
-            StatusCode::OK,
-            "should return 200 for valid sign request"
-        );
-        let json = resp.take_body_str();
+        assert_eq!(resp.status(), StatusCode::OK);
+        let json = response_body_string(resp);
         // Port 9443 should be preserved (URL-encoded as %3A9443)
         assert!(
             json.contains("%3A9443"),
@@ -1487,7 +1596,7 @@ mod tests {
     #[tokio::test]
     async fn click_missing_params_returns_400() {
         let settings = create_test_settings();
-        let req = Request::new(Method::GET, "https://edge.example/first-party/click");
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/click");
         let err: Report<TrustedServerError> =
             handle_first_party_click(&settings, &noop_services(), req)
                 .await
@@ -1502,7 +1611,7 @@ mod tests {
         let params = "foo=1&bar=2";
         let full = format!("{}?{}", tsurl, params);
         let sig = crate::http_util::compute_encrypted_sha256_token(&settings, &full);
-        let req = Request::new(
+        let req = build_http_request(
             Method::GET,
             format!(
                 "https://edge.example/first-party/click?tsurl={}&{}&tstoken={}",
@@ -1514,9 +1623,10 @@ mod tests {
         let resp = handle_first_party_click(&settings, &noop_services(), req)
             .await
             .expect("should redirect");
-        assert_eq!(resp.get_status(), StatusCode::FOUND);
+        assert_eq!(resp.status(), StatusCode::FOUND);
         let loc = resp
-            .get_header(header::LOCATION)
+            .headers()
+            .get(http::header::LOCATION)
             .and_then(|h| h.to_str().ok())
             .unwrap_or("");
         assert_eq!(loc, full);
@@ -1529,7 +1639,7 @@ mod tests {
         let params = "foo=1";
         let full = format!("{}?{}", tsurl, params);
         let sig = crate::http_util::compute_encrypted_sha256_token(&settings, &full);
-        let mut req = Request::new(
+        let mut req = build_http_request(
             Method::GET,
             format!(
                 "https://edge.example/first-party/click?tsurl={}&{}&tstoken={}",
@@ -1538,14 +1648,18 @@ mod tests {
                 sig
             ),
         );
-        req.set_header(crate::constants::HEADER_X_TS_EC, "ec-123");
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC,
+            HeaderValue::from_static("ec-123"),
+        );
 
         let resp = handle_first_party_click(&settings, &noop_services(), req)
             .await
             .expect("should redirect");
 
         let loc = resp
-            .get_header(header::LOCATION)
+            .headers()
+            .get(header::LOCATION)
             .and_then(|h| h.to_str().ok())
             .expect("Location header should be present and valid");
         let parsed = url::Url::parse(loc).expect("Location should be a valid URL");
@@ -1568,16 +1682,18 @@ mod tests {
             "add": {"y": "2"},
             "del": ["x"],
         });
-        let mut req = Request::new(
-            Method::POST,
-            "https://edge.example/first-party/proxy-rebuild",
-        );
-        req.set_body(serde_json::to_string(&body).expect("test JSON should serialize"));
-        let mut resp = handle_first_party_proxy_rebuild(&settings, &noop_services(), req)
+        let req = HttpRequest::builder()
+            .method(Method::POST)
+            .uri("https://edge.example/first-party/proxy-rebuild")
+            .body(EdgeBody::from(
+                serde_json::to_string(&body).expect("test JSON should serialize"),
+            ))
+            .expect("should build proxy rebuild request");
+        let resp = handle_first_party_proxy_rebuild(&settings, &noop_services(), req)
             .await
             .expect("rebuild ok");
-        assert_eq!(resp.get_status(), StatusCode::OK);
-        let json = resp.take_body_str();
+        assert_eq!(resp.status(), StatusCode::OK);
+        let json = response_body_string(resp);
         assert!(json.contains("/first-party/click?tsurl="));
         assert!(json.contains("tstoken"));
         // Diagnostics
@@ -1650,7 +1766,7 @@ mod tests {
         let clear = "ftp://cdn.example/file.gif";
         // Build a first-party proxy URL with a token for the unsupported scheme
         let first_party = creative::build_proxy_url(&settings, clear);
-        let req = Request::new(Method::GET, format!("https://edge.example{}", first_party));
+        let req = build_http_request(Method::GET, format!("https://edge.example{}", first_party));
         let err: Report<TrustedServerError> =
             handle_first_party_proxy(&settings, &noop_services(), req)
                 .await
@@ -1671,7 +1787,7 @@ mod tests {
             url::form_urlencoded::byte_serialize(tsurl.as_bytes()).collect::<String>(),
             sig
         );
-        let req = Request::new(Method::GET, &url);
+        let req = build_http_request(Method::GET, &url);
         let err: Report<TrustedServerError> =
             handle_first_party_proxy(&settings, &noop_services(), req)
                 .await
@@ -1684,15 +1800,12 @@ mod tests {
         let settings = create_test_settings();
         let clear = "https://cdn.example/landing.html?x=1";
         let first_party = creative::build_click_url(&settings, clear);
-        let req = Request::new(Method::GET, format!("https://edge.example{}", first_party));
+        let req = build_http_request(Method::GET, format!("https://edge.example{}", first_party));
         let resp = handle_first_party_click(&settings, &noop_services(), req)
             .await
             .expect("should redirect");
-        assert_eq!(resp.get_status(), StatusCode::FOUND);
-        let cc = resp
-            .get_header(header::CACHE_CONTROL)
-            .and_then(|h| h.to_str().ok())
-            .unwrap_or("");
+        assert_eq!(resp.status(), StatusCode::FOUND);
+        let cc = response_header(&resp, header::CACHE_CONTROL).unwrap_or("");
         assert!(cc.contains("no-store"));
         assert!(cc.contains("private"));
     }
@@ -1707,38 +1820,40 @@ mod tests {
         let settings = create_test_settings();
         // HTML with an external image that should be proxied in rewrite
         let html = r#"<html><body><img src="https://cdn.example/a.png"></body></html>"#;
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .with_header(header::CACHE_CONTROL, "public, max-age=60")
-            .with_header(header::SET_COOKIE, "a=1; Path=/; Secure")
-            .with_body(html);
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(html));
+        beresp.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        );
+        beresp.headers_mut().insert(
+            header::CACHE_CONTROL,
+            HeaderValue::from_static("public, max-age=60"),
+        );
+        beresp.headers_mut().insert(
+            header::SET_COOKIE,
+            HeaderValue::from_static("a=1; Path=/; Secure"),
+        );
         // Sanity: header present and creative rewrite works directly
-        let ct_pre = beresp
-            .get_header(header::CONTENT_TYPE)
-            .and_then(|h| h.to_str().ok())
+        let ct_pre = response_header(&beresp, header::CONTENT_TYPE)
             .unwrap_or("")
             .to_string();
         assert!(ct_pre.contains("text/html"), "ct_pre={}", ct_pre);
         let direct = creative::rewrite_creative_html(&settings, html);
         assert!(direct.contains("/first-party/proxy?tsurl="), "{}", direct);
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
         let out = finalize(&settings, &req, "https://cdn.example/a.png", beresp)
             .expect("finalize should succeed");
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
         assert_eq!(ct, "text/html; charset=utf-8");
-        let cc = out
-            .get_header(header::CACHE_CONTROL)
-            .and_then(|h| h.to_str().ok())
-            .unwrap_or("");
+        let cc = response_header(&out, header::CACHE_CONTROL)
+            .unwrap_or("")
+            .to_string();
         assert_eq!(cc, "public, max-age=60");
-        let cookie = out
-            .get_header(header::SET_COOKIE)
-            .and_then(|h| h.to_str().ok())
-            .unwrap_or("");
+        let cookie = response_header(&out, header::SET_COOKIE)
+            .unwrap_or("")
+            .to_string();
         assert!(cookie.contains("a=1"));
     }
 
@@ -1746,19 +1861,18 @@ mod tests {
     fn css_response_is_rewritten_and_content_type_set() {
         let settings = create_test_settings();
         let css = "body{background:url(https://cdn.example/bg.png)}";
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/css")
-            .with_body(css);
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-        let mut out = finalize(&settings, &req, "https://cdn.example/bg.png", beresp)
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(css));
+        beresp
+            .headers_mut()
+            .insert(header::CONTENT_TYPE, HeaderValue::from_static("text/css"));
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+        let out = finalize(&settings, &req, "https://cdn.example/bg.png", beresp)
             .expect("finalize should succeed");
-        let body = out.take_body_str();
-        assert!(body.contains("/first-party/proxy?tsurl="), "{}", body);
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
+        let body = response_body_string(out);
+        assert!(body.contains("/first-party/proxy?tsurl="), "{}", body);
         assert_eq!(ct, "text/css; charset=utf-8");
     }
 
@@ -1778,12 +1892,14 @@ mod tests {
   </body>
 </html>"#;
 
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .with_body(html);
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(html));
+        beresp.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        );
 
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-        let mut out = finalize(
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+        let out = finalize(
             &settings,
             &req,
             "https://cdn.example.com:9443/creatives/300x250.html",
@@ -1791,7 +1907,7 @@ mod tests {
         )
         .expect("should finalize HTML response with non-standard port URL");
 
-        let body = out.take_body_str();
+        let body = response_body_string(out);
 
         // Port 9443 should be preserved (URL-encoded as %3A9443)
         assert!(
@@ -1804,38 +1920,36 @@ mod tests {
     #[test]
     fn image_accept_sets_generic_content_type_when_missing() {
         let settings = create_test_settings();
-        let beresp = Response::from_status(StatusCode::OK).with_body("PNG");
-        let mut req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-        req.set_header(HEADER_ACCEPT, "image/*");
+        let beresp = build_http_response(StatusCode::OK, EdgeBody::from("PNG"));
+        let mut req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+        req.headers_mut()
+            .insert(HEADER_ACCEPT, HeaderValue::from_static("image/*"));
         let out = finalize(&settings, &req, "https://cdn.example/pixel.gif", beresp)
             .expect("finalize should succeed");
         // Since CT was missing and Accept indicates image, it should set generic image/*
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
-            .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+        let ct = response_header(&out, header::CONTENT_TYPE)
+            .expect("Content-Type header should be present");
         assert_eq!(ct, "image/*");
     }
 
     #[test]
     fn non_image_non_html_passthrough() {
         let settings = create_test_settings();
-        let beresp = Response::from_status(StatusCode::ACCEPTED)
-            .with_header(header::CONTENT_TYPE, "application/json")
-            .with_body("{\"ok\":true}");
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-        let mut out = finalize(&settings, &req, "https://api.example/ok", beresp)
+        let mut beresp = build_http_response(StatusCode::ACCEPTED, EdgeBody::from("{\"ok\":true}"));
+        beresp.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("application/json"),
+        );
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+        let out = finalize(&settings, &req, "https://api.example/ok", beresp)
             .expect("finalize should succeed");
         // Should not rewrite, preserve status and content-type
-        assert_eq!(out.get_status(), StatusCode::ACCEPTED);
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        assert_eq!(out.status(), StatusCode::ACCEPTED);
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
         assert_eq!(ct, "application/json");
-        let body = out.take_body_str();
+        let body = response_body_string(out);
         assert_eq!(body, "{\"ok\":true}");
     }
 
@@ -1856,28 +1970,28 @@ mod tests {
             .expect("gzip write should succeed");
         let compressed = encoder.finish().expect("gzip finish should succeed");
 
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .with_header(header::CONTENT_ENCODING, "gzip")
-            .with_body(compressed);
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(compressed));
+        beresp.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        );
+        beresp
+            .headers_mut()
+            .insert(header::CONTENT_ENCODING, HeaderValue::from_static("gzip"));
 
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
         let out = finalize(&settings, &req, "https://cdn.example/a.png", beresp)
             .expect("finalize should process and succeed");
 
         // Content-Encoding should be preserved (gzip in -> gzip out)
-        let ce = out
-            .get_header(header::CONTENT_ENCODING)
+        let ce = response_header(&out, header::CONTENT_ENCODING)
             .expect("Content-Encoding should be preserved")
-            .to_str()
-            .expect("Content-Encoding should be valid UTF-8");
+            .to_string();
         assert_eq!(ce, "gzip");
 
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
         assert_eq!(ct, "text/html; charset=utf-8");
 
         // Decompress output to verify content was rewritten
@@ -1913,28 +2027,27 @@ mod tests {
                 .expect("brotli write should succeed");
         }
 
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/css")
-            .with_header(header::CONTENT_ENCODING, "br")
-            .with_body(compressed);
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(compressed));
+        beresp
+            .headers_mut()
+            .insert(header::CONTENT_TYPE, HeaderValue::from_static("text/css"));
+        beresp
+            .headers_mut()
+            .insert(header::CONTENT_ENCODING, HeaderValue::from_static("br"));
 
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
         let out = finalize(&settings, &req, "https://cdn.example/bg.png", beresp)
             .expect("finalize should process brotli and succeed");
 
         // Content-Encoding should be preserved (br in -> br out)
-        let ce = out
-            .get_header(header::CONTENT_ENCODING)
+        let ce = response_header(&out, header::CONTENT_ENCODING)
             .expect("Content-Encoding should be preserved")
-            .to_str()
-            .expect("Content-Encoding should be valid UTF-8");
+            .to_string();
         assert_eq!(ce, "br");
 
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
         assert_eq!(ct, "text/css; charset=utf-8");
 
         // Decompress output to verify content was rewritten
@@ -1957,28 +2070,28 @@ mod tests {
         let settings = create_test_settings();
         let html = r#"<html><body><img src="https://cdn.example/a.png"></body></html>"#;
 
-        let beresp = Response::from_status(StatusCode::OK)
-            .with_header(header::CONTENT_TYPE, "text/html; charset=utf-8")
-            .with_body(html);
+        let mut beresp = build_http_response(StatusCode::OK, EdgeBody::from(html));
+        beresp.headers_mut().insert(
+            header::CONTENT_TYPE,
+            HeaderValue::from_static("text/html; charset=utf-8"),
+        );
 
-        let req = Request::new(Method::GET, "https://edge.example/first-party/proxy");
-        let mut out = finalize(&settings, &req, "https://cdn.example/a.png", beresp)
+        let req = build_http_request(Method::GET, "https://edge.example/first-party/proxy");
+        let out = finalize(&settings, &req, "https://cdn.example/a.png", beresp)
             .expect("finalize should succeed");
 
         // No Content-Encoding since input was uncompressed
         assert!(
-            out.get_header(header::CONTENT_ENCODING).is_none(),
+            response_header(&out, header::CONTENT_ENCODING).is_none(),
             "Content-Encoding should not be set for uncompressed input"
         );
 
-        let ct = out
-            .get_header(header::CONTENT_TYPE)
+        let ct = response_header(&out, header::CONTENT_TYPE)
             .expect("Content-Type header should be present")
-            .to_str()
-            .expect("Content-Type should be valid UTF-8");
+            .to_string();
         assert_eq!(ct, "text/html; charset=utf-8");
 
-        let body = out.take_body_str();
+        let body = response_body_string(out);
         assert!(
             body.contains("/first-party/proxy?tsurl="),
             "HTML should be rewritten: {}",
@@ -1998,7 +2111,7 @@ mod tests {
             Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
         );
         let settings = create_test_settings();
-        let req = Request::new(Method::GET, "https://example.com/");
+        let req = build_http_request(Method::GET, "https://example.com/");
 
         let result = proxy_request(
             &settings,
@@ -2036,10 +2149,19 @@ mod tests {
             Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
         );
         let settings = create_test_settings();
-        let mut req = Request::new(Method::GET, "https://example.com/");
-        req.set_header(header::USER_AGENT, "test-agent/1.0");
-        req.set_header(header::ACCEPT, "text/html");
-        req.set_header(header::ACCEPT_LANGUAGE, "en-US");
+        let mut req = HttpRequest::builder()
+            .method(Method::GET)
+            .uri("https://example.com/")
+            .body(EdgeBody::empty())
+            .expect("should build test request");
+        req.headers_mut().insert(
+            header::USER_AGENT,
+            HeaderValue::from_static("test-agent/1.0"),
+        );
+        req.headers_mut()
+            .insert(header::ACCEPT, HeaderValue::from_static("text/html"));
+        req.headers_mut()
+            .insert(header::ACCEPT_LANGUAGE, HeaderValue::from_static("en-US"));
 
         let result = proxy_request(
             &settings,
@@ -2090,14 +2212,21 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn proxy_request_returns_error_for_streaming_platform_response_body() {
+    async fn proxy_request_passes_through_streaming_platform_response_body() {
+        // HTTP types can carry streaming bodies; proxy_request returns Ok even when
+        // the origin sends a streaming body (unlike the old Fastly path which required
+        // materialising the body before wrapping it in fastly::Response).
         let services = build_services_with_http_client(
             Arc::new(StreamingResponseHttpClient) as Arc<dyn PlatformHttpClient>
         );
         let settings = create_test_settings();
-        let req = Request::new(Method::GET, "https://example.com/");
+        let req = HttpRequest::builder()
+            .method(Method::GET)
+            .uri("https://example.com/")
+            .body(EdgeBody::empty())
+            .expect("should build test request");
 
-        let err = proxy_request(
+        let result = proxy_request(
             &settings,
             req,
             ProxyRequestConfig {
@@ -2112,37 +2241,44 @@ mod tests {
             },
             &services,
         )
-        .await
-        .expect_err("should reject streaming platform responses");
+        .await;
 
-        assert_eq!(
-            err.current_context().status_code(),
-            StatusCode::BAD_GATEWAY,
-            "should surface a proxy failure instead of truncating the body"
-        );
         assert!(
-            format!("{err:?}").contains("streaming platform response body"),
-            "should describe the unsupported streaming body: {err:?}"
+            result.is_ok(),
+            "should pass streaming body through with HTTP types: {result:?}"
+        );
+        assert_eq!(
+            result.expect("should succeed").status(),
+            StatusCode::OK,
+            "should preserve the origin status code"
         );
     }
 
     #[test]
     fn rebuild_response_with_body_preserves_multiple_set_cookie_headers() {
-        let mut beresp = Response::from_status(StatusCode::OK);
-        beresp.append_header(header::SET_COOKIE, "a=1; Path=/; Secure");
-        beresp.append_header(header::SET_COOKIE, "b=2; Path=/; Secure");
+        let mut beresp = Response::new(EdgeBody::empty());
+        *beresp.status_mut() = StatusCode::OK;
+        beresp.headers_mut().append(
+            header::SET_COOKIE,
+            HeaderValue::from_static("a=1; Path=/; Secure"),
+        );
+        beresp.headers_mut().append(
+            header::SET_COOKIE,
+            HeaderValue::from_static("b=2; Path=/; Secure"),
+        );
 
         let rebuilt = rebuild_response_with_body(
-            &beresp,
+            beresp,
             "text/html; charset=utf-8",
             b"rewritten".to_vec(),
             false,
         );
 
         let cookies: Vec<String> = rebuilt
-            .get_headers()
-            .filter(|(name, _)| *name == header::SET_COOKIE)
-            .map(|(_, value)| {
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .into_iter()
+            .map(|value| {
                 value
                     .to_str()
                     .expect("should preserve UTF-8 Set-Cookie header values")
@@ -2396,7 +2532,7 @@ mod tests {
             urlencoding::encode(target),
             token,
         );
-        let req = Request::new(Method::GET, url);
+        let req = build_http_request(Method::GET, url);
         let services = crate::platform::test_support::noop_services();
         let err = handle_first_party_proxy(&settings, &services, req)
             .await
@@ -2414,4 +2550,44 @@ mod tests {
             "should be AllowlistViolation error"
         );
     }
+
+    #[tokio::test]
+    async fn sign_rejects_oversized_body() {
+        let settings = create_test_settings();
+        let oversized = vec![b'x'; 65537];
+        let req = HttpRequest::builder()
+            .method(Method::POST)
+            .uri("https://edge.example/first-party/sign")
+            .header(header::CONTENT_TYPE, "application/json")
+            .body(EdgeBody::from(oversized))
+            .expect("should build request");
+        let err = handle_first_party_proxy_sign(&settings, &noop_services(), req)
+            .await
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for oversized sign body"
+        );
+    }
+
+    #[tokio::test]
+    async fn rebuild_rejects_oversized_body() {
+        let settings = create_test_settings();
+        let oversized = vec![b'x'; 65537];
+        let req = HttpRequest::builder()
+            .method(Method::POST)
+            .uri("https://edge.example/first-party/proxy-rebuild")
+            .header(header::CONTENT_TYPE, "application/json")
+            .body(EdgeBody::from(oversized))
+            .expect("should build request");
+        let err = handle_first_party_proxy_rebuild(&settings, &noop_services(), req)
+            .await
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for oversized rebuild body"
+        );
+    }
 }
diff --git a/crates/trusted-server-core/src/publisher.rs b/crates/trusted-server-core/src/publisher.rs
index 12e6f0ba..4582a334 100644
--- a/crates/trusted-server-core/src/publisher.rs
+++ b/crates/trusted-server-core/src/publisher.rs
@@ -1,24 +1,10 @@
-//! Publisher response handler.
-//!
-//! **Note on platform coupling:** This module is currently coupled to
-//! `fastly::Body`/`Request`/`Response` at its handler boundaries — the entry
-//! points ([`handle_publisher_request`], [`stream_publisher_body`]) still
-//! accept and return `fastly::Body` and `fastly::Response`. The streaming
-//! processor itself is generic: [`process_response_streaming`] writes into
-//! any [`Write`] (a `Vec<u8>` for buffered routes, a `StreamingBody` for the
-//! streaming route). The HTTP-type coupling will be addressed in the
-//! platform HTTP-type migration alongside all other
-//! `fastly::Request`/`Response`/`Body` migrations. It is not a
-//! content-rewriting concern.
-
 use std::io::Write;
+use std::time::Duration;
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use fastly::http::{header, StatusCode};
-use fastly::{Body, Request, Response};
+use http::{header, HeaderValue, Request, Response, StatusCode, Uri};
 
-use crate::backend::BackendConfig;
-use crate::compat;
 use crate::consent::{allows_ec_creation, build_consent_context, ConsentPipelineInput};
 use crate::constants::{COOKIE_TS_EC, HEADER_X_COMPRESS_HINT, HEADER_X_TS_EC};
 use crate::cookies::handle_request_cookies;
@@ -26,27 +12,41 @@ use crate::edge_cookie::get_or_generate_ec_id;
 use crate::error::TrustedServerError;
 use crate::http_util::{serve_static_with_etag, RequestInfo};
 use crate::integrations::IntegrationRegistry;
-use crate::platform::RuntimeServices;
+use crate::platform::{PlatformBackendSpec, PlatformHttpRequest, RuntimeServices};
 use crate::rsc_flight::RscFlightUrlRewriter;
 use crate::settings::Settings;
 use crate::streaming_processor::{Compression, PipelineConfig, StreamProcessor, StreamingPipeline};
 use crate::streaming_replacer::create_url_replacer;
 const SUPPORTED_ENCODING_VALUES: [&str; 3] = ["gzip", "deflate", "br"];
+const DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT: Duration = Duration::from_secs(15);
+
+fn body_as_reader(body: EdgeBody) -> std::io::Cursor<bytes::Bytes> {
+    std::io::Cursor::new(body.into_bytes())
+}
 
-fn restrict_accept_encoding(req: &mut Request) {
+fn not_found_response() -> Response<EdgeBody> {
+    let mut response = Response::new(EdgeBody::from("Not Found"));
+    *response.status_mut() = StatusCode::NOT_FOUND;
+    response
+}
+
+fn restrict_accept_encoding(req: &mut Request<EdgeBody>) {
     // If the client sent no Accept-Encoding, leave the request unchanged so the
     // origin responds without compression. Adding encodings here would cause the
     // origin to compress its response even though the client never asked for it,
     // and the client would then receive content it cannot decode.
     let Some(current) = req
-        .get_header(header::ACCEPT_ENCODING)
+        .headers()
+        .get(header::ACCEPT_ENCODING)
         .and_then(|value| value.to_str().ok())
+        .map(str::to_owned)
     else {
         return;
     };
-    req.set_header(
+    req.headers_mut().insert(
         header::ACCEPT_ENCODING,
-        select_supported_accept_encoding(current),
+        HeaderValue::from_str(&select_supported_accept_encoding(&current))
+            .expect("supported accept-encoding should be a valid header value"),
     );
 }
 
@@ -119,27 +119,25 @@ fn accept_encoding_qvalue(header_value: &str, target: &str) -> Option<f32> {
 ///
 /// This function never returns an error; the Result type is for API consistency.
 pub fn handle_tsjs_dynamic(
-    req: &Request,
+    req: &Request<EdgeBody>,
     integration_registry: &IntegrationRegistry,
-) -> Result<Response, Report<TrustedServerError>> {
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     const PREFIX: &str = "/static/tsjs=";
     const UNIFIED_FILENAMES: &[&str] = &["tsjs-unified.js", "tsjs-unified.min.js"];
 
-    let path = req.get_path();
+    let path = req.uri().path();
     if !path.starts_with(PREFIX) {
-        return Ok(Response::from_status(StatusCode::NOT_FOUND).with_body("Not Found"));
+        return Ok(not_found_response());
     }
     let filename = &path[PREFIX.len()..];
-    let http_req = compat::from_fastly_headers_ref(req);
 
     if UNIFIED_FILENAMES.contains(&filename) {
         // Serve core + immediate modules (excludes deferred like prebid)
         let module_ids = integration_registry.js_module_ids_immediate();
         let body = trusted_server_js::concatenate_modules(&module_ids);
-        let http_resp =
-            serve_static_with_etag(&body, &http_req, "application/javascript; charset=utf-8");
-        let mut resp = compat::to_fastly_response(http_resp);
-        resp.set_header(HEADER_X_COMPRESS_HINT, "on");
+        let mut resp = serve_static_with_etag(&body, req, "application/javascript; charset=utf-8");
+        resp.headers_mut()
+            .insert(HEADER_X_COMPRESS_HINT, HeaderValue::from_static("on"));
         return Ok(resp);
     }
 
@@ -147,18 +145,18 @@ pub fn handle_tsjs_dynamic(
         // Only serve if the deferred module is actually enabled
         let deferred_ids = integration_registry.js_module_ids_deferred();
         if !deferred_ids.contains(&module_id) {
-            return Ok(Response::from_status(StatusCode::NOT_FOUND).with_body("Not Found"));
+            return Ok(not_found_response());
         }
         if let Some(content) = trusted_server_js::module_bundle(module_id) {
-            let http_resp =
-                serve_static_with_etag(content, &http_req, "application/javascript; charset=utf-8");
-            let mut resp = compat::to_fastly_response(http_resp);
-            resp.set_header(HEADER_X_COMPRESS_HINT, "on");
+            let mut resp =
+                serve_static_with_etag(content, req, "application/javascript; charset=utf-8");
+            resp.headers_mut()
+                .insert(HEADER_X_COMPRESS_HINT, HeaderValue::from_static("on"));
             return Ok(resp);
         }
     }
 
-    Ok(Response::from_status(StatusCode::NOT_FOUND).with_body("Not Found"))
+    Ok(not_found_response())
 }
 
 /// Extract a module ID from a deferred-module filename like `tsjs-prebid.min.js`.
@@ -200,7 +198,7 @@ struct ProcessResponseParams<'a> {
 ///
 /// Returns an error if processor creation or chunk processing fails.
 fn process_response_streaming<W: Write>(
-    body: Body,
+    body: EdgeBody,
     output: &mut W,
     params: &ProcessResponseParams,
 ) -> Result<(), Report<TrustedServerError>> {
@@ -230,7 +228,7 @@ fn process_response_streaming<W: Write>(
             params.settings,
             params.integration_registry,
         )?;
-        StreamingPipeline::new(config, processor).process(body, output)?;
+        StreamingPipeline::new(config, processor).process(body_as_reader(body), output)?;
     } else if is_rsc_flight {
         let processor = RscFlightUrlRewriter::new(
             params.origin_host,
@@ -238,7 +236,7 @@ fn process_response_streaming<W: Write>(
             params.request_host,
             params.request_scheme,
         );
-        StreamingPipeline::new(config, processor).process(body, output)?;
+        StreamingPipeline::new(config, processor).process(body_as_reader(body), output)?;
     } else {
         let replacer = create_url_replacer(
             params.origin_host,
@@ -246,7 +244,7 @@ fn process_response_streaming<W: Write>(
             params.request_host,
             params.request_scheme,
         );
-        StreamingPipeline::new(config, replacer).process(body, output)?;
+        StreamingPipeline::new(config, replacer).process(body_as_reader(body), output)?;
     }
 
     Ok(())
@@ -277,7 +275,7 @@ fn create_html_stream_processor(
 /// body should be streamed or has already been buffered.
 pub enum PublisherResponse {
     /// Response is fully buffered and ready to send via `send_to_client()`.
-    Buffered(Response),
+    Buffered(Response<EdgeBody>),
     /// Response headers are ready for a streaming response. Covers processable
     /// content on any status (2xx or non-2xx — e.g., branded 404/500 HTML and
     /// error JSON still get URL rewriting) where the encoding is supported
@@ -290,26 +288,23 @@ pub enum PublisherResponse {
     Stream {
         /// Response with all headers set (EC ID, cookies, etc.)
         /// but body not yet written. `Content-Length` already removed.
-        response: Response,
+        response: Response<EdgeBody>,
         /// Origin body to be piped through the streaming pipeline.
-        body: Body,
+        body: EdgeBody,
         /// Parameters for `process_response_streaming`.
         params: OwnedProcessResponseParams,
     },
     /// Non-processable 2xx response (images, fonts, video). The adapter must
-    /// reattach the body via `response.set_body(body)` before returning.
+    /// reattach the body via setting the body before returning.
     /// `finalize_response()` and `send_to_client()` are applied at the outer
     /// response-dispatch level, not in this arm.
     ///
-    /// `Content-Length` is preserved — the body is unmodified. Using
-    /// `send_to_client()` instead of `stream_to_client()` avoids chunked
-    /// encoding overhead. Fastly streams the body from its internal buffer
-    /// without copying into WASM memory.
+    /// `Content-Length` is preserved — the body is unmodified.
     PassThrough {
         /// Response with all headers set but body not yet written.
-        response: Response,
+        response: Response<EdgeBody>,
         /// Origin body to stream directly to the client.
-        body: Body,
+        body: EdgeBody,
     },
 }
 
@@ -404,13 +399,18 @@ pub struct OwnedProcessResponseParams {
 /// Called by the adapter after `stream_to_client()` has committed the
 /// response headers. Writes processed chunks directly to `output`.
 ///
+/// This is `async` because it uses `services.http_client().send(...).await` rather
+/// than the synchronous Fastly SDK `req.send()`. The only caller wraps the entire
+/// route handler in `block_on`, so behavior is equivalent — the change reflects the
+/// migration to the platform-agnostic HTTP client.
+///
 /// # Errors
 ///
 /// Returns an error if processing fails mid-stream. Since headers are
 /// already committed, the caller should log the error and drop the
 /// `StreamingBody` (client sees a truncated response).
 pub fn stream_publisher_body<W: Write>(
-    body: Body,
+    body: EdgeBody,
     output: &mut W,
     params: &OwnedProcessResponseParams,
     settings: &Settings,
@@ -446,21 +446,19 @@ pub fn stream_publisher_body<W: Write>(
 ///
 /// Returns a [`TrustedServerError`] if the proxy request fails or the
 /// origin backend is unreachable.
-pub fn handle_publisher_request(
+pub async fn handle_publisher_request(
     settings: &Settings,
     integration_registry: &IntegrationRegistry,
     services: &RuntimeServices,
-    mut req: Request,
+    mut req: Request<EdgeBody>,
 ) -> Result<PublisherResponse, Report<TrustedServerError>> {
     log::debug!("Proxying request to publisher_origin");
 
     // Prebid.js requests are not intercepted here anymore. The HTML processor removes
     // publisher-supplied Prebid scripts; the unified TSJS bundle includes Prebid.js when enabled.
 
-    let http_req = compat::from_fastly_headers_ref(&req);
-
     // Extract request host and scheme (uses Host header and TLS detection after edge sanitization)
-    let request_info = RequestInfo::from_request(&http_req, &services.client_info);
+    let request_info = RequestInfo::from_request(&req, services.client_info());
     let request_host = &request_info.host;
     let request_scheme = &request_info.scheme;
 
@@ -468,13 +466,13 @@ pub fn handle_publisher_request(
         "Request info: host={}, scheme={} (X-Forwarded-Host: {:?}, Host: {:?}, X-Forwarded-Proto: {:?})",
         request_host,
         request_scheme,
-        req.get_header("x-forwarded-host"),
-        req.get_header(header::HOST),
-        req.get_header("x-forwarded-proto"),
+        req.headers().get("x-forwarded-host"),
+        req.headers().get(header::HOST),
+        req.headers().get("x-forwarded-proto"),
     );
 
     // Parse cookies once for reuse by both consent extraction and EC ID logic.
-    let cookie_jar = handle_request_cookies(&http_req)?;
+    let cookie_jar = handle_request_cookies(&req)?;
 
     // Capture the current EC cookie value for revocation handling.
     // This must come from the cookie itself (not the x-ts-ec header)
@@ -496,14 +494,14 @@ pub fn handle_publisher_request(
     // and falls back to stored consent when cookies are absent.
     let geo = services
         .geo()
-        .lookup(services.client_info.client_ip)
+        .lookup(services.client_info().client_ip)
         .unwrap_or_else(|e| {
             log::warn!("geo lookup failed: {e}");
             None
         });
     let consent_context = build_consent_context(&ConsentPipelineInput {
         jar: cookie_jar.as_ref(),
-        req: &http_req,
+        req: &req,
         config: &settings.consent,
         geo: geo.as_ref(),
         ec_id: Some(ec_id.as_str()),
@@ -516,11 +514,40 @@ pub fn handle_publisher_request(
     let ec_allowed = allows_ec_creation(&consent_context);
     log::debug!("Proxy ec_allowed: {}", ec_allowed);
 
-    let backend_name = BackendConfig::from_url(
-        &settings.publisher.origin_url,
-        settings.proxy.certificate_check,
+    let parsed_origin = url::Url::parse(&settings.publisher.origin_url).change_context(
+        TrustedServerError::Proxy {
+            message: format!("Invalid origin_url: {}", settings.publisher.origin_url),
+        },
     )?;
+    let origin_scheme = parsed_origin.scheme().to_string();
+    let origin_host_without_port = parsed_origin.host_str().ok_or_else(|| {
+        Report::new(TrustedServerError::Proxy {
+            message: "Missing host in origin_url".to_string(),
+        })
+    })?;
+    let backend_name = services
+        .backend()
+        .ensure(&PlatformBackendSpec {
+            scheme: origin_scheme.clone(),
+            host: origin_host_without_port.to_string(),
+            port: parsed_origin.port(),
+            certificate_check: settings.proxy.certificate_check,
+            first_byte_timeout: DEFAULT_PUBLISHER_FIRST_BYTE_TIMEOUT,
+        })
+        .change_context(TrustedServerError::Proxy {
+            message: "backend registration failed".to_string(),
+        })?;
     let origin_host = settings.publisher.origin_host();
+    let origin_path_and_query = req
+        .uri()
+        .path_and_query()
+        .map(http::uri::PathAndQuery::as_str)
+        .unwrap_or("/");
+    let target_uri = format!("{origin_scheme}://{origin_host}{origin_path_and_query}")
+        .parse::<Uri>()
+        .change_context(TrustedServerError::Proxy {
+            message: "invalid publisher origin uri".to_string(),
+        })?;
 
     log::debug!(
         "Proxying to dynamic backend: {} (from {})",
@@ -529,16 +556,25 @@ pub fn handle_publisher_request(
     );
     // Only advertise encodings the rewrite pipeline can decode and re-encode.
     restrict_accept_encoding(&mut req);
-    req.set_header("host", &origin_host);
+    *req.uri_mut() = target_uri;
+    req.headers_mut().insert(
+        header::HOST,
+        HeaderValue::from_str(&origin_host).change_context(TrustedServerError::Proxy {
+            message: "invalid publisher origin host header".to_string(),
+        })?,
+    );
 
-    let mut response = req
-        .send(&backend_name)
+    let mut response = services
+        .http_client()
+        .send(PlatformHttpRequest::new(req, backend_name))
+        .await
         .change_context(TrustedServerError::Proxy {
             message: "Failed to proxy request to origin".to_string(),
-        })?;
+        })?
+        .response;
 
     log::debug!("Response headers:");
-    for (name, value) in response.get_headers() {
+    for (name, value) in response.headers() {
         log::debug!("  {}: {:?}", name, value);
     }
 
@@ -555,14 +591,16 @@ pub fn handle_publisher_request(
     );
 
     let content_type = response
-        .get_header(header::CONTENT_TYPE)
+        .headers()
+        .get(header::CONTENT_TYPE)
         .map(|h| h.to_str().unwrap_or_default())
         .unwrap_or_default()
         .to_string();
 
-    let status = response.get_status();
+    let status = response.status();
     let content_encoding = response
-        .get_header(header::CONTENT_ENCODING)
+        .headers()
+        .get(header::CONTENT_ENCODING)
         .map(|h| h.to_str().unwrap_or_default())
         .unwrap_or_default()
         .to_lowercase();
@@ -583,7 +621,8 @@ pub fn handle_publisher_request(
                 content_type,
                 status,
             );
-            let body = response.take_body();
+            let (parts, body) = response.into_parts();
+            let response = Response::from_parts(parts, EdgeBody::empty());
             Ok(PublisherResponse::PassThrough { response, body })
         }
         ResponseRoute::BufferedUnmodified => {
@@ -617,8 +656,8 @@ pub fn handle_publisher_request(
                 content_type, content_encoding, request_host, origin_host
             );
 
-            let body = response.take_body();
-            response.remove_header(header::CONTENT_LENGTH);
+            let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
+            response.headers_mut().remove(header::CONTENT_LENGTH);
 
             Ok(PublisherResponse::Stream {
                 response,
@@ -639,7 +678,7 @@ pub fn handle_publisher_request(
                 content_type, content_encoding, request_host, origin_host
             );
 
-            let body = response.take_body();
+            let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
             let params = ProcessResponseParams {
                 content_encoding: &content_encoding,
                 origin_host: &origin_host,
@@ -653,8 +692,11 @@ pub fn handle_publisher_request(
             let mut output = Vec::new();
             process_response_streaming(body, &mut output, &params)?;
 
-            response.set_header(header::CONTENT_LENGTH, output.len().to_string());
-            response.set_body(Body::from(output));
+            response.headers_mut().insert(
+                header::CONTENT_LENGTH,
+                HeaderValue::from(output.len() as u64),
+            );
+            *response.body_mut() = EdgeBody::from(output);
 
             Ok(PublisherResponse::Buffered(response))
         }
@@ -692,26 +734,33 @@ fn is_supported_content_encoding(encoding: &str) -> bool {
 fn apply_ec_headers(
     settings: &Settings,
     services: &RuntimeServices,
-    response: &mut Response,
+    response: &mut Response<EdgeBody>,
     ec_id: &str,
     ec_allowed: bool,
     existing_ec_cookie: Option<&str>,
     consent_context: &crate::consent::ConsentContext,
 ) {
     if ec_allowed {
-        // Fastly's HeaderValue API rejects \r, \n, and \0, so the EC ID
+        // HeaderValue::from_str rejects \r, \n, and \0, so the EC ID
         // cannot inject additional response headers.
-        response.set_header(HEADER_X_TS_EC, ec_id);
+        match HeaderValue::from_str(ec_id) {
+            Ok(v) => {
+                response.headers_mut().insert(HEADER_X_TS_EC, v);
+            }
+            Err(_) => {
+                log::warn!("Rejecting EC ID response header: value is not a valid header value");
+            }
+        }
         // Cookie persistence is skipped if the EC ID contains RFC 6265-illegal
         // characters. The header is still emitted when consent allows it.
-        compat::set_fastly_ec_cookie(settings, response, ec_id);
+        crate::cookies::set_ec_cookie(settings, response, ec_id);
     } else if let Some(cookie_ec_id) = existing_ec_cookie {
         log::info!(
             "EC revoked for '{}': consent withdrawn (jurisdiction={})",
             cookie_ec_id,
             consent_context.jurisdiction,
         );
-        compat::expire_fastly_ec_cookie(settings, response);
+        crate::cookies::expire_ec_cookie(settings, response);
         if settings.consent.consent_store.is_some() {
             crate::consent::kv::delete_consent_from_kv(services.kv_store(), cookie_ec_id);
         }
@@ -727,9 +776,26 @@ fn apply_ec_headers(
 mod tests {
     use super::*;
     use crate::integrations::IntegrationRegistry;
-    use crate::platform::test_support::noop_services;
+    use crate::platform::test_support::{
+        build_services_with_http_client, noop_services, StubHttpClient,
+    };
     use crate::test_support::tests::create_test_settings;
-    use fastly::http::{header, Method, StatusCode};
+    use edgezero_core::body::Body as EdgeBody;
+    use http::{header, Method, Request as HttpRequest, StatusCode};
+    use std::sync::Arc;
+
+    fn build_request(method: Method, uri: &str) -> HttpRequest<EdgeBody> {
+        HttpRequest::builder()
+            .method(method)
+            .uri(uri)
+            .body(EdgeBody::empty())
+            .expect("should build test request")
+    }
+
+    fn response_body_string(response: http::Response<EdgeBody>) -> String {
+        String::from_utf8(response.into_body().into_bytes().to_vec())
+            .expect("response body should be valid UTF-8")
+    }
 
     #[test]
     fn test_content_type_detection() {
@@ -1071,25 +1137,30 @@ mod tests {
         // Verify byte-for-byte identity and Content-Length preservation.
         let image_bytes: Vec<u8> = (0..=255).cycle().take(4096).collect();
 
-        let mut response = Response::from_status(StatusCode::OK);
-        response.set_header("content-type", "image/png");
-        response.set_header("content-length", image_bytes.len().to_string());
-        response.set_body(Body::from(image_bytes.clone()));
+        let mut response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "image/png")
+            .header(header::CONTENT_LENGTH, image_bytes.len() as u64)
+            .body(EdgeBody::from(image_bytes.clone()))
+            .expect("should build test response");
 
         // Simulate PassThrough: take body then reattach
-        let body = response.take_body();
+        let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
         // Body is unmodified — Content-Length stays correct
         assert_eq!(
             response
-                .get_header_str("content-length")
+                .headers()
+                .get(header::CONTENT_LENGTH)
+                .and_then(|v| v.to_str().ok())
                 .expect("should have content-length"),
             "4096",
             "Content-Length should be preserved for pass-through"
         );
 
         // Reattach and verify body content
-        response.set_body(body);
-        let output = response.into_body().into_bytes();
+        *response.body_mut() = body;
+        let (_, final_body) = response.into_parts();
+        let output = final_body.into_bytes();
         assert_eq!(
             output, image_bytes,
             "pass-through should preserve body byte-for-byte"
@@ -1102,15 +1173,23 @@ mod tests {
         let test_encodings = vec!["gzip", "deflate", "br", "identity", ""];
 
         for encoding in test_encodings {
-            let mut req = Request::new(Method::GET, "https://test.example.com/page");
-            req.set_header("accept-encoding", "gzip, deflate, br");
+            let mut req = build_request(Method::GET, "https://test.example.com/page");
+            req.headers_mut().insert(
+                header::ACCEPT_ENCODING,
+                http::HeaderValue::from_static("gzip, deflate, br"),
+            );
 
             if !encoding.is_empty() {
-                req.set_header("content-encoding", encoding);
+                req.headers_mut().insert(
+                    header::CONTENT_ENCODING,
+                    http::HeaderValue::from_str(encoding)
+                        .expect("content encoding should be valid"),
+                );
             }
 
             let content_encoding = req
-                .get_header("content-encoding")
+                .headers()
+                .get(header::CONTENT_ENCODING)
                 .map(|h| h.to_str().unwrap_or_default())
                 .unwrap_or_default();
 
@@ -1120,13 +1199,13 @@ mod tests {
 
     #[test]
     fn publisher_proxy_does_not_add_accept_encoding_when_absent() {
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
         // No Accept-Encoding header set by the client.
 
         restrict_accept_encoding(&mut req);
 
         assert_eq!(
-            req.get_header_str(header::ACCEPT_ENCODING),
+            req.headers().get(header::ACCEPT_ENCODING),
             None,
             "publisher proxy should not inject Accept-Encoding when the client sent none"
         );
@@ -1134,13 +1213,18 @@ mod tests {
 
     #[test]
     fn publisher_proxy_limits_accept_encoding_to_supported_values() {
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header(header::ACCEPT_ENCODING, "gzip, deflate, br, zstd");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
+        req.headers_mut().insert(
+            header::ACCEPT_ENCODING,
+            http::HeaderValue::from_static("gzip, deflate, br, zstd"),
+        );
 
         restrict_accept_encoding(&mut req);
 
         assert_eq!(
-            req.get_header_str(header::ACCEPT_ENCODING),
+            req.headers()
+                .get(header::ACCEPT_ENCODING)
+                .and_then(|value| value.to_str().ok()),
             Some("gzip, deflate, br"),
             "publisher fallback should only advertise encodings the rewrite pipeline supports"
         );
@@ -1148,13 +1232,18 @@ mod tests {
 
     #[test]
     fn publisher_proxy_preserves_identity_only_accept_encoding() {
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header(header::ACCEPT_ENCODING, "identity");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
+        req.headers_mut().insert(
+            header::ACCEPT_ENCODING,
+            http::HeaderValue::from_static("identity"),
+        );
 
         restrict_accept_encoding(&mut req);
 
         assert_eq!(
-            req.get_header_str(header::ACCEPT_ENCODING),
+            req.headers()
+                .get(header::ACCEPT_ENCODING)
+                .and_then(|value| value.to_str().ok()),
             Some("identity"),
             "publisher fallback should preserve identity-only clients"
         );
@@ -1162,13 +1251,18 @@ mod tests {
 
     #[test]
     fn publisher_proxy_respects_supported_client_subset() {
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header(header::ACCEPT_ENCODING, "br, gzip;q=0, zstd");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
+        req.headers_mut().insert(
+            header::ACCEPT_ENCODING,
+            http::HeaderValue::from_static("br, gzip;q=0, zstd"),
+        );
 
         restrict_accept_encoding(&mut req);
 
         assert_eq!(
-            req.get_header_str(header::ACCEPT_ENCODING),
+            req.headers()
+                .get(header::ACCEPT_ENCODING)
+                .and_then(|value| value.to_str().ok()),
             Some("br"),
             "publisher fallback should only advertise the supported encodings the client accepts"
         );
@@ -1176,13 +1270,18 @@ mod tests {
 
     #[test]
     fn publisher_proxy_falls_back_to_identity_for_unsupported_client_encodings() {
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header(header::ACCEPT_ENCODING, "zstd");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
+        req.headers_mut().insert(
+            header::ACCEPT_ENCODING,
+            http::HeaderValue::from_static("zstd"),
+        );
 
         restrict_accept_encoding(&mut req);
 
         assert_eq!(
-            req.get_header_str(header::ACCEPT_ENCODING),
+            req.headers()
+                .get(header::ACCEPT_ENCODING)
+                .and_then(|value| value.to_str().ok()),
             Some("identity"),
             "publisher fallback should request identity when the client only accepts unsupported encodings"
         );
@@ -1191,12 +1290,17 @@ mod tests {
     #[test]
     fn revocation_targets_cookie_ec_id_not_header() {
         let settings = create_test_settings();
-        let mut req = Request::new(Method::GET, "https://test.example.com/page");
-        req.set_header("x-ts-ec", "header_id");
-        req.set_header("cookie", "ts-ec=cookie_id; other=value");
+        let mut req = build_request(Method::GET, "https://test.example.com/page");
+        req.headers_mut().insert(
+            crate::constants::HEADER_X_TS_EC,
+            http::HeaderValue::from_static("header_id"),
+        );
+        req.headers_mut().insert(
+            header::COOKIE,
+            http::HeaderValue::from_static("ts-ec=cookie_id; other=value"),
+        );
 
-        let http_req = compat::from_fastly_headers_ref(&req);
-        let cookie_jar = handle_request_cookies(&http_req).expect("should parse cookies");
+        let cookie_jar = handle_request_cookies(&req).expect("should parse cookies");
         let existing_ec_cookie = cookie_jar
             .as_ref()
             .and_then(|jar| jar.get(COOKIE_TS_EC))
@@ -1221,13 +1325,13 @@ mod tests {
         let settings = create_test_settings();
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://publisher.example/static/tsjs=unknown.js",
         );
 
         let response = handle_tsjs_dynamic(&req, &registry).expect("should handle tsjs request");
-        assert_eq!(response.get_status(), StatusCode::NOT_FOUND);
+        assert_eq!(response.status(), StatusCode::NOT_FOUND);
     }
 
     #[test]
@@ -1235,13 +1339,13 @@ mod tests {
         let settings = create_test_settings();
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://publisher.example/static/tsjs=tsjs-unified.min.js",
         );
 
         let response = handle_tsjs_dynamic(&req, &registry).expect("should handle tsjs request");
-        assert_eq!(response.get_status(), StatusCode::OK);
+        assert_eq!(response.status(), StatusCode::OK);
     }
 
     #[test]
@@ -1288,14 +1392,14 @@ mod tests {
         let settings = create_test_settings();
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://publisher.example/static/tsjs=tsjs-prebid.min.js",
         );
 
         let response = handle_tsjs_dynamic(&req, &registry).expect("should handle tsjs request");
         assert_eq!(
-            response.get_status(),
+            response.status(),
             StatusCode::OK,
             "should serve deferred prebid module when enabled"
         );
@@ -1316,14 +1420,14 @@ mod tests {
             .expect("should update prebid config");
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://publisher.example/static/tsjs=tsjs-prebid.min.js",
         );
 
         let response = handle_tsjs_dynamic(&req, &registry).expect("should handle tsjs request");
         assert_eq!(
-            response.get_status(),
+            response.status(),
             StatusCode::NOT_FOUND,
             "should return 404 for disabled deferred module"
         );
@@ -1334,19 +1438,57 @@ mod tests {
         let settings = create_test_settings();
         let registry =
             IntegrationRegistry::new(&settings).expect("should create integration registry");
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://publisher.example/static/tsjs=tsjs-evil.min.js",
         );
 
         let response = handle_tsjs_dynamic(&req, &registry).expect("should handle tsjs request");
         assert_eq!(
-            response.get_status(),
+            response.status(),
             StatusCode::NOT_FOUND,
             "should reject unknown module names"
         );
     }
 
+    #[tokio::test]
+    async fn publisher_request_uses_platform_http_client_with_http_types() {
+        let settings = create_test_settings();
+        let registry =
+            IntegrationRegistry::new(&settings).expect("should create integration registry");
+        let stub = Arc::new(StubHttpClient::new());
+        stub.push_response(200, b"origin response".to_vec());
+        let services = build_services_with_http_client(
+            Arc::clone(&stub) as Arc<dyn crate::platform::PlatformHttpClient>
+        );
+        let req = HttpRequest::builder()
+            .method(Method::GET)
+            .uri("https://publisher.example/page")
+            .header(header::HOST, "publisher.example")
+            .body(EdgeBody::empty())
+            .expect("should build request");
+
+        let pub_response = handle_publisher_request(&settings, &registry, &services, req)
+            .await
+            .expect("should proxy publisher request");
+        let response = match pub_response {
+            PublisherResponse::Buffered(r) => r,
+            PublisherResponse::PassThrough { mut response, body } => {
+                *response.body_mut() = body;
+                response
+            }
+            PublisherResponse::Stream { response, .. } => response,
+        };
+
+        assert_eq!(response.status(), StatusCode::OK);
+        assert_eq!(response_body_string(response), "origin response");
+        assert_eq!(
+            stub.recorded_backend_names(),
+            vec!["stub-backend".to_string()],
+            "should proxy through the platform http client"
+        );
+    }
+
     #[test]
     fn stream_publisher_body_preserves_gzip_round_trip() {
         use flate2::write::GzEncoder;
@@ -1366,7 +1508,7 @@ mod tests {
             encoder.finish().expect("should finish compression");
         }
 
-        let body = Body::from(compressed);
+        let body = EdgeBody::from(compressed);
         let params = OwnedProcessResponseParams {
             content_encoding: "gzip".to_string(),
             origin_host: "origin.example.com".to_string(),
@@ -1418,8 +1560,14 @@ mod tests {
         };
 
         let mut output = Vec::new();
-        stream_publisher_body(Body::new(), &mut output, &params, &settings, &registry)
-            .expect("should succeed on empty body");
+        stream_publisher_body(
+            EdgeBody::empty(),
+            &mut output,
+            &params,
+            &settings,
+            &registry,
+        )
+        .expect("should succeed on empty body");
 
         assert!(
             output.is_empty(),
@@ -1449,7 +1597,7 @@ mod tests {
             content_type: "text/html".to_string(),
         };
 
-        let bogus_body = Body::from(b"<html>not gzip</html>".to_vec());
+        let bogus_body = EdgeBody::from(b"<html>not gzip</html>".to_vec());
         let mut output = Vec::new();
         let result = stream_publisher_body(bogus_body, &mut output, &params, &settings, &registry);
 
@@ -1473,22 +1621,27 @@ mod tests {
         // reattachment half of the contract.
         let image_bytes: Vec<u8> = (0..=127).cycle().take(2048).collect();
 
-        let mut response = Response::from_status(StatusCode::OK);
-        response.set_header(header::CONTENT_TYPE, "image/png");
-        response.set_header(header::CONTENT_LENGTH, image_bytes.len().to_string());
-        response.set_body(Body::from(image_bytes.clone()));
+        let mut response = Response::builder()
+            .status(StatusCode::OK)
+            .header(header::CONTENT_TYPE, "image/png")
+            .header(header::CONTENT_LENGTH, image_bytes.len() as u64)
+            .body(EdgeBody::from(image_bytes.clone()))
+            .expect("should build test response");
 
         // Mirror adapter: take body, then reattach.
-        let body = response.take_body();
-        response.set_body(body);
+        let body = std::mem::replace(response.body_mut(), EdgeBody::empty());
+        *response.body_mut() = body;
 
         assert_eq!(
             response
-                .get_header_str(header::CONTENT_LENGTH)
+                .headers()
+                .get(header::CONTENT_LENGTH)
+                .and_then(|v| v.to_str().ok())
                 .expect("content-length should survive"),
             "2048"
         );
-        let round_trip = response.into_body().into_bytes();
+        let (_, final_body) = response.into_parts();
+        let round_trip = final_body.into_bytes();
         assert_eq!(
             round_trip, image_bytes,
             "pass-through reattach must preserve bytes exactly"
@@ -1537,7 +1690,7 @@ mod tests {
         // BufferedProcessed arm uses (Vec<u8> output).
         let html =
             b"<html><body><a href=\"https://origin.example.com/page\">link</a></body></html>";
-        let body = Body::from(html.to_vec());
+        let body = EdgeBody::from(html.to_vec());
 
         let params = OwnedProcessResponseParams {
             content_encoding: String::new(),
@@ -1600,7 +1753,7 @@ mod tests {
 
         let mut output = Vec::new();
         stream_publisher_body(
-            Body::from(html.to_vec()),
+            EdgeBody::from(html.to_vec()),
             &mut output,
             &params,
             &settings,
diff --git a/crates/trusted-server-core/src/request_signing/endpoints.rs b/crates/trusted-server-core/src/request_signing/endpoints.rs
index 988d747f..f0b3410a 100644
--- a/crates/trusted-server-core/src/request_signing/endpoints.rs
+++ b/crates/trusted-server-core/src/request_signing/endpoints.rs
@@ -3,8 +3,9 @@
 //! This module provides endpoint handlers for JWKS retrieval, signature verification,
 //! key rotation, and key deactivation operations.
 
+use edgezero_core::body::Body as EdgeBody;
 use error_stack::{Report, ResultExt};
-use fastly::{Request, Response};
+use http::{header, Request, Response, StatusCode};
 use serde::{Deserialize, Serialize};
 
 use crate::error::{IntoHttpResponse, TrustedServerError};
@@ -14,6 +15,14 @@ use crate::request_signing::rotation::KeyRotationManager;
 use crate::request_signing::signing;
 use crate::settings::Settings;
 
+fn json_response(status: StatusCode, body: String) -> Response<EdgeBody> {
+    Response::builder()
+        .status(status)
+        .header(header::CONTENT_TYPE, mime::APPLICATION_JSON.as_ref())
+        .body(EdgeBody::from(body.into_bytes()))
+        .expect("should build json response")
+}
+
 /// Retrieves and returns the trusted-server discovery document.
 ///
 /// This endpoint provides a standardized discovery mechanism following the IAB
@@ -26,8 +35,8 @@ use crate::settings::Settings;
 pub fn handle_trusted_server_discovery(
     _settings: &Settings,
     services: &RuntimeServices,
-    _req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    _req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let jwks_json = crate::request_signing::jwks::get_active_jwks(services).change_context(
         TrustedServerError::Configuration {
             message: "failed to retrieve JWKS".into(),
@@ -47,9 +56,7 @@ pub fn handle_trusted_server_discovery(
         },
     )?;
 
-    Ok(Response::from_status(200)
-        .with_content_type(mime::APPLICATION_JSON)
-        .with_body(json))
+    Ok(json_response(StatusCode::OK, json))
 }
 
 /// JSON request body for the signature verification endpoint.
@@ -77,6 +84,9 @@ pub struct VerifySignatureResponse {
     pub error: Option<String>,
 }
 
+const VERIFY_MAX_BODY_BYTES: usize = 4096;
+const ADMIN_MAX_BODY_BYTES: usize = 4096;
+
 /// Will verify a signature given a payload and kid
 /// Useful for testing integration with signatures
 ///
@@ -87,11 +97,20 @@ pub struct VerifySignatureResponse {
 pub fn handle_verify_signature(
     _settings: &Settings,
     services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
-    let body = req.take_body_str();
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
+    let body = req.into_body().into_bytes();
+    if body.len() > VERIFY_MAX_BODY_BYTES {
+        return Err(Report::new(TrustedServerError::RequestTooLarge {
+            message: format!(
+                "verify-signature payload {} exceeds limit of {}",
+                body.len(),
+                VERIFY_MAX_BODY_BYTES,
+            ),
+        }));
+    }
     let verify_req: VerifySignatureRequest =
-        serde_json::from_str(&body).change_context(TrustedServerError::Configuration {
+        serde_json::from_slice(&body).change_context(TrustedServerError::Configuration {
             message: "invalid JSON request body".into(),
         })?;
 
@@ -132,9 +151,7 @@ pub fn handle_verify_signature(
         })
     })?;
 
-    Ok(Response::from_status(200)
-        .with_content_type(mime::APPLICATION_JSON)
-        .with_body(response_json))
+    Ok(json_response(StatusCode::OK, response_json))
 }
 
 /// JSON request body for the key-rotation endpoint.
@@ -226,18 +243,27 @@ fn validate_kid(kid: &str) -> Result<(), Report<TrustedServerError>> {
 pub fn handle_rotate_key(
     settings: &Settings,
     services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let SigningStoreIds {
         config_store_id,
         secret_store_id,
     } = signing_store_ids(settings)?;
 
-    let body = req.take_body_str();
+    let body = req.into_body().into_bytes();
+    if body.len() > ADMIN_MAX_BODY_BYTES {
+        return Err(Report::new(TrustedServerError::RequestTooLarge {
+            message: format!(
+                "rotate-key payload {} exceeds limit of {}",
+                body.len(),
+                ADMIN_MAX_BODY_BYTES,
+            ),
+        }));
+    }
     let rotate_req: RotateKeyRequest = if body.is_empty() {
         RotateKeyRequest { kid: None }
     } else {
-        serde_json::from_str(&body).change_context(TrustedServerError::Configuration {
+        serde_json::from_slice(&body).change_context(TrustedServerError::Configuration {
             message: "invalid JSON request body".into(),
         })?
     };
@@ -274,9 +300,7 @@ pub fn handle_rotate_key(
                 })
             })?;
 
-            Ok(Response::from_status(200)
-                .with_content_type(mime::APPLICATION_JSON)
-                .with_body(response_json))
+            Ok(json_response(StatusCode::OK, response_json))
         }
         Err(e) => {
             let status = e.current_context().status_code();
@@ -296,9 +320,7 @@ pub fn handle_rotate_key(
                 })
             })?;
 
-            Ok(Response::from_status(status)
-                .with_content_type(mime::APPLICATION_JSON)
-                .with_body(response_json))
+            Ok(json_response(status, response_json))
         }
     }
 }
@@ -348,16 +370,25 @@ pub struct DeactivateKeyResponse {
 pub fn handle_deactivate_key(
     settings: &Settings,
     services: &RuntimeServices,
-    mut req: Request,
-) -> Result<Response, Report<TrustedServerError>> {
+    req: Request<EdgeBody>,
+) -> Result<Response<EdgeBody>, Report<TrustedServerError>> {
     let SigningStoreIds {
         config_store_id,
         secret_store_id,
     } = signing_store_ids(settings)?;
 
-    let body = req.take_body_str();
+    let body = req.into_body().into_bytes();
+    if body.len() > ADMIN_MAX_BODY_BYTES {
+        return Err(Report::new(TrustedServerError::RequestTooLarge {
+            message: format!(
+                "deactivate-key payload {} exceeds limit of {}",
+                body.len(),
+                ADMIN_MAX_BODY_BYTES,
+            ),
+        }));
+    }
     let deactivate_req: DeactivateKeyRequest =
-        serde_json::from_str(&body).change_context(TrustedServerError::Configuration {
+        serde_json::from_slice(&body).change_context(TrustedServerError::Configuration {
             message: "invalid JSON request body".into(),
         })?;
 
@@ -397,9 +428,7 @@ pub fn handle_deactivate_key(
                 })
             })?;
 
-            Ok(Response::from_status(200)
-                .with_content_type(mime::APPLICATION_JSON)
-                .with_body(response_json))
+            Ok(json_response(StatusCode::OK, response_json))
         }
         Err(e) => {
             let status = e.current_context().status_code();
@@ -422,22 +451,53 @@ pub fn handle_deactivate_key(
                 })
             })?;
 
-            Ok(Response::from_status(status)
-                .with_content_type(mime::APPLICATION_JSON)
-                .with_body(response_json))
+            Ok(json_response(status, response_json))
         }
     }
 }
 
 #[cfg(test)]
 mod tests {
+    use edgezero_core::body::Body as EdgeBody;
+    use error_stack::Report;
+    use http::{header, Method, Request as HttpRequest, StatusCode};
+
+    use crate::error::IntoHttpResponse;
     use crate::platform::{
         test_support::{build_request_signing_services, build_services_with_config, noop_services},
         PlatformConfigStore, PlatformError, StoreId, StoreName,
     };
 
     use super::*;
-    use fastly::http::{Method, StatusCode};
+
+    fn build_request(method: Method, uri: &str, body: Option<&str>) -> HttpRequest<EdgeBody> {
+        let body = match body {
+            Some(body) => EdgeBody::from(body.as_bytes().to_vec()),
+            None => EdgeBody::empty(),
+        };
+
+        HttpRequest::builder()
+            .method(method)
+            .uri(uri)
+            .body(body)
+            .expect("should build request")
+    }
+
+    fn response_body_string(response: http::Response<EdgeBody>) -> String {
+        String::from_utf8(response.into_body().into_bytes().to_vec())
+            .expect("should decode response body")
+    }
+
+    fn assert_json_content_type(response: &http::Response<EdgeBody>) {
+        assert_eq!(
+            response
+                .headers()
+                .get(header::CONTENT_TYPE)
+                .and_then(|value| value.to_str().ok()),
+            Some(mime::APPLICATION_JSON.as_ref()),
+            "should return application/json content type"
+        );
+    }
 
     /// Config store stub that returns a minimal JWKS with one Ed25519 key.
     struct StubJwksConfigStore;
@@ -482,19 +542,18 @@ mod tests {
         };
 
         let body = serde_json::to_string(&verify_req).expect("should serialize verify request");
-        let mut req = Request::new(Method::POST, "https://test.com/verify-signature");
-        req.set_body(body);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/verify-signature",
+            Some(&body),
+        );
 
-        let mut resp = handle_verify_signature(&settings, &services, req)
+        let resp = handle_verify_signature(&settings, &services, req)
             .expect("should handle verification request");
-        assert_eq!(resp.get_status(), StatusCode::OK);
-        assert_eq!(
-            resp.get_content_type(),
-            Some(mime::APPLICATION_JSON),
-            "should return application/json content type"
-        );
+        assert_eq!(resp.status(), StatusCode::OK);
+        assert_json_content_type(&resp);
 
-        let resp_body = resp.take_body_str();
+        let resp_body = response_body_string(resp);
         let verify_resp: VerifySignatureResponse =
             serde_json::from_str(&resp_body).expect("should deserialize verify response");
 
@@ -522,19 +581,18 @@ mod tests {
         };
 
         let body = serde_json::to_string(&verify_req).expect("should serialize verify request");
-        let mut req = Request::new(Method::POST, "https://test.com/verify-signature");
-        req.set_body(body);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/verify-signature",
+            Some(&body),
+        );
 
-        let mut resp = handle_verify_signature(&settings, &services, req)
+        let resp = handle_verify_signature(&settings, &services, req)
             .expect("should handle verification request");
-        assert_eq!(resp.get_status(), StatusCode::OK);
-        assert_eq!(
-            resp.get_content_type(),
-            Some(mime::APPLICATION_JSON),
-            "should return application/json content type"
-        );
+        assert_eq!(resp.status(), StatusCode::OK);
+        assert_json_content_type(&resp);
 
-        let resp_body = resp.take_body_str();
+        let resp_body = response_body_string(resp);
         let verify_resp: VerifySignatureResponse =
             serde_json::from_str(&resp_body).expect("should deserialize verify response");
 
@@ -557,16 +615,19 @@ mod tests {
         };
 
         let body = serde_json::to_string(&verify_req).expect("should serialize verify request");
-        let mut req = Request::new(Method::POST, "https://test.com/verify-signature");
-        req.set_body(body);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/verify-signature",
+            Some(&body),
+        );
 
         let services = noop_services();
-        let mut resp = handle_verify_signature(&settings, &services, req)
+        let resp = handle_verify_signature(&settings, &services, req)
             .expect("should return a verification response for internal errors");
 
-        assert_eq!(resp.get_status(), StatusCode::OK, "should return 200 OK");
+        assert_eq!(resp.status(), StatusCode::OK, "should return 200 OK");
 
-        let resp_body = resp.take_body_str();
+        let resp_body = response_body_string(resp);
         let verify_resp: VerifySignatureResponse =
             serde_json::from_str(&resp_body).expect("should deserialize verify response");
 
@@ -591,8 +652,11 @@ mod tests {
     fn test_handle_verify_signature_malformed_request() {
         let settings = crate::test_support::tests::create_test_settings();
 
-        let mut req = Request::new(Method::POST, "https://test.com/verify-signature");
-        req.set_body("not valid json");
+        let req = build_request(
+            Method::POST,
+            "https://test.com/verify-signature",
+            Some("not valid json"),
+        );
 
         let result = handle_verify_signature(&settings, &noop_services(), req);
         assert!(result.is_err(), "Malformed JSON should error");
@@ -601,18 +665,18 @@ mod tests {
     #[test]
     fn test_handle_rotate_key_with_empty_body() {
         let settings = crate::test_support::tests::create_test_settings();
-        let req = Request::new(Method::POST, "https://test.com/admin/keys/rotate");
+        let req = build_request(Method::POST, "https://test.com/admin/keys/rotate", None);
 
-        let mut resp = handle_rotate_key(&settings, &noop_services(), req)
+        let resp = handle_rotate_key(&settings, &noop_services(), req)
             .expect("should return a response even when stores are unavailable");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::INTERNAL_SERVER_ERROR,
             "should return 500 when store writes fail"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: RotateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize rotate response");
 
@@ -635,19 +699,22 @@ mod tests {
         };
 
         let body_json = serde_json::to_string(&req_body).expect("should serialize rotate request");
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/rotate");
-        req.set_body(body_json);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/rotate",
+            Some(&body_json),
+        );
 
-        let mut resp = handle_rotate_key(&settings, &noop_services(), req)
+        let resp = handle_rotate_key(&settings, &noop_services(), req)
             .expect("should return a response even when stores are unavailable");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::INTERNAL_SERVER_ERROR,
             "should return 500 when store writes fail"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: RotateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize rotate response");
 
@@ -664,8 +731,11 @@ mod tests {
     #[test]
     fn test_handle_rotate_key_invalid_json() {
         let settings = crate::test_support::tests::create_test_settings();
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/rotate");
-        req.set_body("invalid json");
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/rotate",
+            Some("invalid json"),
+        );
 
         let result = handle_rotate_key(&settings, &noop_services(), req);
         assert!(result.is_err(), "Invalid JSON should return error");
@@ -680,19 +750,22 @@ mod tests {
         };
 
         let body_json = serde_json::to_string(&req_body).expect("should serialize rotate request");
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/rotate");
-        req.set_body(body_json);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/rotate",
+            Some(&body_json),
+        );
 
-        let mut resp = handle_rotate_key(&settings, &noop_services(), req)
+        let resp = handle_rotate_key(&settings, &noop_services(), req)
             .expect("should return a response for invalid kid");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::BAD_REQUEST,
             "should reject malformed kid as a bad request"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: RotateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize rotate response");
 
@@ -720,19 +793,22 @@ mod tests {
 
         let body_json =
             serde_json::to_string(&req_body).expect("should serialize deactivate request");
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/deactivate");
-        req.set_body(body_json);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/deactivate",
+            Some(&body_json),
+        );
 
-        let mut resp = handle_deactivate_key(&settings, &noop_services(), req)
+        let resp = handle_deactivate_key(&settings, &noop_services(), req)
             .expect("should return a response even when stores are unavailable");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::INTERNAL_SERVER_ERROR,
             "should return 500 when active-kids cannot be read"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: DeactivateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize deactivate response");
 
@@ -757,19 +833,22 @@ mod tests {
 
         let body_json =
             serde_json::to_string(&req_body).expect("should serialize deactivate request");
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/deactivate");
-        req.set_body(body_json);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/deactivate",
+            Some(&body_json),
+        );
 
-        let mut resp = handle_deactivate_key(&settings, &noop_services(), req)
+        let resp = handle_deactivate_key(&settings, &noop_services(), req)
             .expect("should return a response even when stores are unavailable");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::INTERNAL_SERVER_ERROR,
             "should return 500 when active-kids cannot be read"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: DeactivateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize deactivate response");
 
@@ -790,8 +869,11 @@ mod tests {
     #[test]
     fn test_handle_deactivate_key_invalid_json() {
         let settings = crate::test_support::tests::create_test_settings();
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/deactivate");
-        req.set_body("invalid json");
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/deactivate",
+            Some("invalid json"),
+        );
 
         let result = handle_deactivate_key(&settings, &noop_services(), req);
         assert!(result.is_err(), "Invalid JSON should return error");
@@ -808,19 +890,22 @@ mod tests {
 
         let body_json =
             serde_json::to_string(&req_body).expect("should serialize deactivate request");
-        let mut req = Request::new(Method::POST, "https://test.com/admin/keys/deactivate");
-        req.set_body(body_json);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/deactivate",
+            Some(&body_json),
+        );
 
-        let mut resp = handle_deactivate_key(&settings, &noop_services(), req)
+        let resp = handle_deactivate_key(&settings, &noop_services(), req)
             .expect("should return a response for invalid kid");
 
         assert_eq!(
-            resp.get_status(),
+            resp.status(),
             StatusCode::BAD_REQUEST,
             "should reject malformed kid as a bad request"
         );
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let response: DeactivateKeyResponse =
             serde_json::from_str(&body).expect("should deserialize deactivate response");
 
@@ -837,6 +922,60 @@ mod tests {
         );
     }
 
+    #[test]
+    fn verify_signature_rejects_oversized_body() {
+        let settings = crate::test_support::tests::create_test_settings();
+        let oversized = "x".repeat(VERIFY_MAX_BODY_BYTES + 1);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/verify-signature",
+            Some(&oversized),
+        );
+        let err = handle_verify_signature(&settings, &noop_services(), req)
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for verify-signature body over limit"
+        );
+    }
+
+    #[test]
+    fn rotate_key_rejects_oversized_body() {
+        let settings = crate::test_support::tests::create_test_settings();
+        let oversized = "x".repeat(ADMIN_MAX_BODY_BYTES + 1);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/rotate",
+            Some(&oversized),
+        );
+        let err = handle_rotate_key(&settings, &noop_services(), req)
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for rotate-key body over limit"
+        );
+    }
+
+    #[test]
+    fn deactivate_key_rejects_oversized_body() {
+        let settings = crate::test_support::tests::create_test_settings();
+        let oversized = "x".repeat(ADMIN_MAX_BODY_BYTES + 1);
+        let req = build_request(
+            Method::POST,
+            "https://test.com/admin/keys/deactivate",
+            Some(&oversized),
+        );
+        let err = handle_deactivate_key(&settings, &noop_services(), req)
+            .expect_err("should reject oversized body");
+        assert_eq!(
+            err.current_context().status_code(),
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "should return 413 for deactivate-key body over limit"
+        );
+    }
+
     #[test]
     fn validate_kid_accepts_allowed_operator_supplied_ids() {
         validate_kid("azAZ09-_.:").expect("should accept allowed kid characters");
@@ -883,9 +1022,10 @@ mod tests {
     #[test]
     fn test_handle_trusted_server_discovery() {
         let settings = crate::test_support::tests::create_test_settings();
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://test.com/.well-known/trusted-server.json",
+            None,
         );
 
         // noop_services() config store always returns Err, so the discovery
@@ -901,18 +1041,19 @@ mod tests {
     #[test]
     fn test_handle_trusted_server_discovery_returns_jwks_document() {
         let settings = crate::test_support::tests::create_test_settings();
-        let req = Request::new(
+        let req = build_request(
             Method::GET,
             "https://test.com/.well-known/trusted-server.json",
+            None,
         );
 
         let services = build_services_with_config(StubJwksConfigStore);
-        let mut resp = handle_trusted_server_discovery(&settings, &services, req)
+        let resp = handle_trusted_server_discovery(&settings, &services, req)
             .expect("should return discovery document when config store is populated");
 
-        assert_eq!(resp.get_status(), StatusCode::OK, "should return 200 OK");
+        assert_eq!(resp.status(), StatusCode::OK, "should return 200 OK");
 
-        let body = resp.take_body_str();
+        let body = response_body_string(resp);
         let discovery: serde_json::Value =
             serde_json::from_str(&body).expect("should parse discovery document as JSON");
 
diff --git a/crates/trusted-server-core/src/settings.rs b/crates/trusted-server-core/src/settings.rs
index 78549262..e62153d7 100644
--- a/crates/trusted-server-core/src/settings.rs
+++ b/crates/trusted-server-core/src/settings.rs
@@ -504,6 +504,19 @@ impl Settings {
             handler.prepare_runtime()?;
         }
 
+        for (name, value) in &self.response_headers {
+            http::header::HeaderName::from_bytes(name.as_bytes()).map_err(|_| {
+                Report::new(TrustedServerError::Configuration {
+                    message: format!("Invalid response header name: {name}"),
+                })
+            })?;
+            http::header::HeaderValue::from_str(value).map_err(|_| {
+                Report::new(TrustedServerError::Configuration {
+                    message: format!("Invalid response header value for {name}"),
+                })
+            })?;
+        }
+
         Ok(())
     }