diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index bf90139..a64ec47 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -5710,7 +5710,7 @@ dependencies = [
  "tokio",
  "url",
  "windows-sys 0.60.2",
- "zip",
+ "zip 4.6.1",
 ]
 
 [[package]]
@@ -5907,6 +5907,7 @@ checksum = "743bd48c283afc0388f9b8827b976905fb217ad9e647fae3a379a9283c4def2c"
 dependencies = [
  "deranged",
  "itoa",
+ "js-sys",
  "num-conv",
  "powerfmt",
  "serde_core",
@@ -6316,6 +6317,12 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e421abadd41a4225275504ea4d6566923418b7f05506fbc9c0fe86ba7396114b"
 
+[[package]]
+name = "typed-path"
+version = "0.12.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e28f89b80c87b8fb0cf04ab448d5dd0dd0ade2f8891bae878de66a75a28600e"
+
 [[package]]
 name = "typeid"
 version = "1.0.3"
@@ -6753,7 +6760,7 @@ dependencies = [
  "url",
  "uuid 1.23.1",
  "walkdir",
- "zip",
+ "zip 8.6.0",
 ]
 
 [[package]]
@@ -7851,11 +7858,23 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "caa8cd6af31c3b31c6631b8f483848b91589021b28fffe50adada48d4f4d2ed1"
 dependencies = [
  "arbitrary",
+ "crc32fast",
+ "indexmap 2.14.0",
+ "memchr",
+]
+
+[[package]]
+name = "zip"
+version = "8.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+dependencies = [
  "crc32fast",
  "flate2",
  "indexmap 2.14.0",
  "memchr",
  "time",
+ "typed-path",
  "zopfli",
 ]
 
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index c9cd778..b0e7d13 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -177,7 +177,7 @@ uuid = { version = "1", features = ["v4", "v5"] }
 # user's manual artwork into a single `.waveflow` (zip) file. We pick
 # zip 4.x for its `deflate` feature with a pure-Rust backend (no
 # native libz dep), keeping the cross-compile story clean.
-zip = { version = "4", default-features = false, features = ["deflate", "time"] }
+zip = { version = "8", default-features = false, features = ["deflate", "time"] }
 
 # Discord Rich Presence — speaks the local Discord client's IPC named
 # pipe (no network). Mirrors the souvlaki integration in