diff --git a/.github/workflows/tauri-build.yml b/.github/workflows/tauri-build.yml
index 710b1cd97e..9dfa16cad2 100644
--- a/.github/workflows/tauri-build.yml
+++ b/.github/workflows/tauri-build.yml
@@ -457,7 +457,7 @@ jobs:
 
   updater-manifest:
     name: Publish updater manifest
-    needs: [setup-release, build, android]
+    needs: [setup-release, build]
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 98a9129c16..275dfffb24 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -6441,7 +6441,7 @@ dependencies = [
 [[package]]
 name = "tauri-plugin-notifications"
 version = "0.5.0-rc.11"
-source = "git+https://github.com/SableClient/tauri-plugin-notifications.git?rev=4ea297bdeffaba6a8e2e4386a18fbd4dd59fa0f0#4ea297bdeffaba6a8e2e4386a18fbd4dd59fa0f0"
+source = "git+https://github.com/SableClient/tauri-plugin-notifications.git?rev=0ca647a8d762cbba2ecfbefed7ff13565ec46229#0ca647a8d762cbba2ecfbefed7ff13565ec46229"
 dependencies = [
  "log",
  "notify-rust",
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index f26f453bd2..9e163155bc 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -52,7 +52,11 @@ tauri-plugin-clipboard-manager = "2.3.2"
 
 # Debug-only in practice: only initialized under #[cfg(debug_assertions)] in
 # lib.rs, so the release build never calls into it.
-tauri-plugin-devtools = "2.0.0"
+# default-features = false drops the plugin's `wry` feature (which enables
+# `tauri/wry`); Sable's own `wry` feature already enables `tauri/wry` for wry
+# builds, and CEF builds (--no-default-features --features cef) must not pull
+# wry/tauri-runtime-wry/webkit2gtk.
+tauri-plugin-devtools = { version = "2.0.0", default-features = false }
 
 [target.'cfg(target_os = "windows")'.dependencies]
 enigo = "0.5.0"
@@ -67,12 +71,12 @@ windows = { version = "0.61", features = [
 tauri-plugin-single-instance = { version = "2.4.3", features = ["deep-link"] }
 
 [target.'cfg(any(windows, target_os = "linux"))'.dependencies]
-tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "4ea297bdeffaba6a8e2e4386a18fbd4dd59fa0f0" }
+tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "0ca647a8d762cbba2ecfbefed7ff13565ec46229" }
 
 # default-features = false drops notify-rust so macOS uses the native
 # UNUserNotificationCenter backend (needs a signed .app to deliver).
 [target.'cfg(target_os = "macos")'.dependencies]
-tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "4ea297bdeffaba6a8e2e4386a18fbd4dd59fa0f0", default-features = false }
+tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "0ca647a8d762cbba2ecfbefed7ff13565ec46229", default-features = false }
 
 [target.'cfg(not(any(target_os = "android", target_os = "ios")))'.dependencies]
 tauri-plugin-updater = { version = "2", optional = true }
@@ -82,10 +86,9 @@ tauri-plugin-window-state = "2.4.1"
 
 [target.'cfg(any(target_os = "linux", target_os = "dragonfly", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"))'.dependencies]
 gtk = "0.18"
-
-# WebKitGTK is the wry runtime; not needed under CEF.
-[target.'cfg(all(any(target_os = "linux", target_os = "dragonfly", target_os = "freebsd", target_os = "openbsd", target_os = "netbsd"), not(feature = "cef")))'.dependencies]
-webkit2gtk = "2.0"
+# Used directly in lib.rs for WebKitGTK permission handling (wry only).
+# Optional + gated via the `wry` feature so CEF builds don't pull it.
+webkit2gtk = { version = "2.0", optional = true }
 
 # CEF (Chromium) runtime — Linux only; other platforms use wry.
 # Repackage of tauri's unreleased feat/cef branch. Switch to the official
@@ -96,7 +99,7 @@ cef = { version = "=148.0.0", optional = true }
 libloading = "0.8"
 
 [target.'cfg(any(target_os = "android", target_os = "ios"))'.dependencies]
-tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "4ea297bdeffaba6a8e2e4386a18fbd4dd59fa0f0", features = [
+tauri-plugin-notifications = { git = "https://github.com/SableClient/tauri-plugin-notifications.git", rev = "0ca647a8d762cbba2ecfbefed7ff13565ec46229", features = [
   "push-notifications",
 ] }
 tauri-plugin-edge-to-edge = { git = "https://github.com/SableClient/tauri-plugin-edge-to-edge.git", rev = "33c6116c27be28c06df5a9d02231ecc5fdeb93c5" }
@@ -111,7 +114,7 @@ jni = "0.21"
 [features]
 default = ["wry", "updater"]
 custom-protocol = ["tauri/custom-protocol"]
-wry = ["tauri/wry"]
+wry = ["tauri/wry", "dep:webkit2gtk"]
 # Tauri auto-updater. Disable with --no-default-features --features wry,cef.
 updater = ["dep:tauri-plugin-updater"]
 # CEF (Chromium) runtime. Build with --no-default-features --features cef.