diff --git a/bun.lock b/bun.lock
index 394166a3..223ef599 100644
--- a/bun.lock
+++ b/bun.lock
@@ -14,7 +14,7 @@
         "@profullstack/pairux-embed": "^0.1.0",
         "@profullstack/stack": "^0.5.0",
         "@profullstack/text-type-detection": "^1.0.0",
-        "@profullstack/x402-gateway": "^0.13.1",
+        "@profullstack/x402-gateway": "^0.15.1",
         "@simplewebauthn/browser": "^14.0.0",
         "@simplewebauthn/server": "^14.0.3",
         "@supabase/ssr": "^0.12.7",
@@ -390,7 +390,7 @@
 
     "@profullstack/text-type-detection": ["@profullstack/text-type-detection@1.0.0", "", {}, "sha512-3tG0Icz2gwLfwbOwdYxgCTTcjCyAAhEnU82ReIrbOQiN8f3R84WrPLWfE4Pqg/ce57VFVPpNkSmd5doaXKV+dw=="],
 
-    "@profullstack/x402-gateway": ["@profullstack/x402-gateway@0.13.1", "", { "dependencies": { "@profullstack/keys": "^0.1.0" } }, "sha512-V7liSO0tShZRlp8dancuDuUSF/rqrr5YF3bzLoZy9wn6ixf1RIRPYTepe72s36JOdSVzi3wfuhaZFm9y0RpV4w=="],
+    "@profullstack/x402-gateway": ["@profullstack/x402-gateway@0.15.1", "", { "dependencies": { "@profullstack/keys": "^0.1.0" } }, "sha512-yw4q8XAtop9p6jHV3z5tRnCF7af8O7pn7ZlbuWeeN87XXtynFNZnoJFd1xZTTHEj994Bvnxg9yIjwkv7coI4rQ=="],
 
     "@rolldown/binding-android-arm-eabi": ["@rolldown/binding-android-arm-eabi@1.2.15", "", { "os": "android", "cpu": "arm" }, "sha512-aLcgK9gIJ3YRvrrtfSBbRa27F5WrpiTaPulnFpsHPxpUHgFlSgnU4854MHwoRGEBhfRJDWCS2WQ7lIjskE9Olw=="],
 
diff --git a/package.json b/package.json
index b18cd269..9611a1cc 100644
--- a/package.json
+++ b/package.json
@@ -66,7 +66,7 @@
     "@profullstack/pairux-embed": "^0.1.0",
     "@profullstack/stack": "^0.5.0",
     "@profullstack/text-type-detection": "^1.0.0",
-    "@profullstack/x402-gateway": "^0.13.1",
+    "@profullstack/x402-gateway": "^0.15.1",
     "@simplewebauthn/browser": "^14.0.0",
     "@simplewebauthn/server": "^14.0.3",
     "@supabase/ssr": "^0.12.7",
diff --git a/tests/cli/exit.test.js b/tests/cli/exit.test.js
index 454726b8..251baf83 100644
--- a/tests/cli/exit.test.js
+++ b/tests/cli/exit.test.js
@@ -29,7 +29,12 @@ describe('exitWhenFlushed', () => {
 		expect(run('exitWhenFlushed(3);').status).toBe(3);
 	});
 
-	it('is needed: a bare process.exit truncates at the pipe buffer', () => {
+	// Why exitWhenFlushed exists: a bare process.exit usually truncates at the
+	// pipe buffer. "Usually" is the problem: whether the reader drains in time
+	// is up to the runner, and CI flushed the whole 1 MiB twice on 2026-10-28,
+	// so asserting the truncation made the suite flaky. The test above pins the
+	// behaviour that matters.
+	it.skip('is needed: a bare process.exit truncates at the pipe buffer', () => {
 		expect(run('process.exit(0);').stdout.length).toBeLessThan(SIZE);
 	});
 });