diff --git a/.changeset/refresh-scaffold-consumers.md b/.changeset/refresh-scaffold-consumers.md
index 6f3d6260f..69575d3ee 100644
--- a/.changeset/refresh-scaffold-consumers.md
+++ b/.changeset/refresh-scaffold-consumers.md
@@ -2,4 +2,4 @@
 "create-agent-bundle": patch
 ---
 
-Update the `minimal`, `mcp-server`, and `cli-tool` templates to `@types/node` 26.5.1, update the routed templates to React 19.3.0, and move the `mcp-server` template to `@types/react` 19.3.0 while preserving the `zod` 4.5.4 runtime peer floor. (#808)
+Update the `minimal`, `mcp-server`, and `cli-tool` templates to `@types/node` 26.5.1, update the routed templates to React 19.3.0, and move the `mcp-server` template to `@types/react` 19.3.0. (#808)
diff --git a/.changeset/zod-4-6-4-floor.md b/.changeset/zod-4-6-4-floor.md
new file mode 100644
index 000000000..318934cf9
--- /dev/null
+++ b/.changeset/zod-4-6-4-floor.md
@@ -0,0 +1,7 @@
+---
+"@agent-bundle/runtime": minor
+"agent-bundle": patch
+"create-agent-bundle": patch
+---
+
+Raise the `@agent-bundle/runtime` `zod` peer floor from `^4.5.4` to `^4.6.4`: projects on `zod@4.5.x` or earlier must upgrade their direct `zod` dependency before installing the runtime, or npm rejects the required peer with `ERESOLVE`. `agent-bundle` now compiles its bundled schemas with `zod` 4.6.4, and the `cli-tool` and `mcp-server` scaffold templates pin `zod@4.6.4` to satisfy the new peer. (#842)
diff --git a/examples/audiobook-curator/package.json b/examples/audiobook-curator/package.json
index f97f0b455..31998d27d 100644
--- a/examples/audiobook-curator/package.json
+++ b/examples/audiobook-curator/package.json
@@ -29,6 +29,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/examples/host-test/package.json b/examples/host-test/package.json
index bca804ca7..147fd38cf 100644
--- a/examples/host-test/package.json
+++ b/examples/host-test/package.json
@@ -27,6 +27,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/examples/mcp-app/package.json b/examples/mcp-app/package.json
index 86c2f02f8..2af1997ee 100644
--- a/examples/mcp-app/package.json
+++ b/examples/mcp-app/package.json
@@ -21,6 +21,6 @@
     "agent-bundle": "workspace:*",
     "playwright": "1.63.0",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/examples/rsc-agent-runtime/package.json b/examples/rsc-agent-runtime/package.json
index 731eab861..516d0f5d1 100644
--- a/examples/rsc-agent-runtime/package.json
+++ b/examples/rsc-agent-runtime/package.json
@@ -24,7 +24,7 @@
     "react": "19.3.0",
     "react-dom": "19.3.0",
     "react-server-dom-rspack": "0.1.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@rsbuild/core": "2.2.5",
diff --git a/examples/worktree-proximity/package.json b/examples/worktree-proximity/package.json
index 8655bad3a..edc4b1dbb 100644
--- a/examples/worktree-proximity/package.json
+++ b/examples/worktree-proximity/package.json
@@ -27,6 +27,6 @@
     "@types/react": "19.3.0",
     "agent-bundle": "workspace:*",
     "react": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/packages/agent-bundle/package.json b/packages/agent-bundle/package.json
index 7068f9822..8707ce20b 100644
--- a/packages/agent-bundle/package.json
+++ b/packages/agent-bundle/package.json
@@ -139,7 +139,7 @@
     "effect-rstest": "https://pkg.pr.new/ScriptedAlchemy/effect-rstest@e5f8d5f",
     "react": "19.3.0",
     "typescript-5": "npm:typescript@5.9.3",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "peerDependencies": {
     "@agent-bundle/runtime": ">=0.0.0 <1",
diff --git a/packages/agent-bundle/tests/check-declaration-imports.test.ts b/packages/agent-bundle/tests/check-declaration-imports.test.ts
index 108713125..61f225922 100644
--- a/packages/agent-bundle/tests/check-declaration-imports.test.ts
+++ b/packages/agent-bundle/tests/check-declaration-imports.test.ts
@@ -18,7 +18,7 @@ import { removeTree } from './support/remove-tree.ts';
 const manifest: DeclarationManifest = {
   name: 'fixture-package',
   dependencies: { effect: '4.0.0', '@modelcontextprotocol/client': '2.0.0' },
-  devDependencies: { zod: '4.5.4', 'typescript-5': 'npm:typescript@5.9.3', '@types/node': '26.4.0' },
+  devDependencies: { zod: '4.6.4', 'typescript-5': 'npm:typescript@5.9.3', '@types/node': '26.4.0' },
   exports: {
     '.': { types: './dist/index.d.ts', import: './dist/index.js' },
     './routes': { types: './dist/routes/public.d.ts', import: './dist/routes.js' },
@@ -172,7 +172,7 @@ describe('declarationImportViolations', () => {
     const report = declarationImportViolations({
       manifest: {
         name: 'agent-bundle',
-        devDependencies: { zod: '4.5.4' },
+        devDependencies: { zod: '4.6.4' },
         exports: { './app': { types: './dist/app.d.ts', import: './dist/app.js' } },
       },
       packedPaths: ['dist/app.d.ts', 'dist/app.js'],
@@ -410,7 +410,7 @@ describe('the packed-declaration gate', () => {
     type: 'module',
     exports: { '.': { types: './dist/index.d.ts', import: './dist/index.js' }, './package.json': './package.json' },
     dependencies: { effect: '4.0.0' },
-    devDependencies: { zod: '4.5.4' },
+    devDependencies: { zod: '4.6.4' },
   };
   const badFiles = {
     'package.json': `${JSON.stringify(badManifest, null, 2)}\n`,
@@ -445,7 +445,7 @@ describe('the packed-declaration gate', () => {
   });
 
   it('passes the same pack once the import is declared, and lets --strict fail internal declarations', async () => {
-    const goodManifest = { ...badManifest, name: 'good-fixture', dependencies: { effect: '4.0.0', zod: '4.5.4' }, devDependencies: {} };
+    const goodManifest = { ...badManifest, name: 'good-fixture', dependencies: { effect: '4.0.0', zod: '4.6.4' }, devDependencies: {} };
     const root = await writeFixturePack({
       ...badFiles,
       'package.json': `${JSON.stringify(goodManifest, null, 2)}\n`,
diff --git a/packages/agent-bundle/tests/dev-workbench-packaging.test.ts b/packages/agent-bundle/tests/dev-workbench-packaging.test.ts
index 5f886f820..8caa39b8a 100644
--- a/packages/agent-bundle/tests/dev-workbench-packaging.test.ts
+++ b/packages/agent-bundle/tests/dev-workbench-packaging.test.ts
@@ -132,7 +132,7 @@ it('packages both react-server render children and renders a route invocation fr
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: consumer, env: installedEnvironment() });
     await mkdir(join(project, 'src', 'mcp', 'status', 'tools'), { recursive: true });
     await Promise.all([
diff --git a/packages/agent-bundle/tests/function-authoring-build.test.ts b/packages/agent-bundle/tests/function-authoring-build.test.ts
index 6e99f60a9..61642adf8 100644
--- a/packages/agent-bundle/tests/function-authoring-build.test.ts
+++ b/packages/agent-bundle/tests/function-authoring-build.test.ts
@@ -13,7 +13,7 @@ it('runs compiled function events, explicit JSX views, and CLI metadata and JSON
   try {
     await symlink(join(process.cwd(), 'examples/audiobook-curator/node_modules'), join(root, 'node_modules'), 'dir');
     const files = {
-      'package.json': JSON.stringify({ name: 'function-authoring', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', react: '19.2.8', zod: '4.5.4' } }),
+      'package.json': JSON.stringify({ name: 'function-authoring', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', react: '19.2.8', zod: '4.6.4' } }),
       'agent-bundle.config.ts': `import { defineConfig } from 'agent-bundle/config'; export default defineConfig({ plugin: { name: 'function-authoring' }, targets: ['claude'] });`,
       'src/providers/unused.ts': `throw new Error('unused provider evaluated'); export default () => 'unused';`,
       'src/providers/policy.ts': `export default () => 'Writes disabled';`,
@@ -157,7 +157,7 @@ it('mounts identities, state, notices, and provider observations in a compiled l
   try {
     await symlink(join(process.cwd(), 'examples/audiobook-curator/node_modules'), join(root, 'node_modules'), 'dir');
     const files = {
-      'package.json': JSON.stringify({ name: 'event-context', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', zod: '4.5.4' } }),
+      'package.json': JSON.stringify({ name: 'event-context', type: 'module', version: '1.0.0', dependencies: { '@agent-bundle/runtime': 'workspace:*', zod: '4.6.4' } }),
       'agent-bundle.config.ts': `import { defineConfig } from 'agent-bundle/config'; export default defineConfig({ plugin: { name: 'event-context' }, targets: ['claude'] });`,
       'src/state.ts': `import { defineState } from '@agent-bundle/runtime/state'; import { z } from 'zod';
 export default defineState({ id: 'event-context/state', lifetime: 'workspace-durable', initial: { count: 7 }, schema: z.object({ count: z.number() }), events: { tick: z.object({}) }, reduce: (state) => state });`,
diff --git a/packages/agent-bundle/tests/packed-readonly-state-root.test.ts b/packages/agent-bundle/tests/packed-readonly-state-root.test.ts
index 2c9a830fe..fb4ceee4d 100644
--- a/packages/agent-bundle/tests/packed-readonly-state-root.test.ts
+++ b/packages/agent-bundle/tests/packed-readonly-state-root.test.ts
@@ -94,7 +94,7 @@ it('serves a state-writing tool from a read-only installed artifact without writ
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: project, env: installedEnvironment() });
     const cli = join(project, 'node_modules', '.bin', 'agent-bundle');
     await execFile(cli, ['build', '--root', project, '--output', artifact], {
diff --git a/packages/agent-bundle/tests/packed-stdio-projection.test.ts b/packages/agent-bundle/tests/packed-stdio-projection.test.ts
index 92c3d3827..1109b6a1d 100644
--- a/packages/agent-bundle/tests/packed-stdio-projection.test.ts
+++ b/packages/agent-bundle/tests/packed-stdio-projection.test.ts
@@ -98,7 +98,7 @@ it.each([
       markdownStream.tarball,
       'react@19.2.8',
       'react-dom@19.2.8',
-      'zod@4.5.4',
+      'zod@4.6.4',
     ], { cwd: project, env: installedEnvironment() });
 
     // The fixture selects `claude`, the only target whose capabilities cover
diff --git a/packages/agent-bundle/tests/packed-web-command.test.ts b/packages/agent-bundle/tests/packed-web-command.test.ts
index 156a1ea78..0b0fa23a2 100644
--- a/packages/agent-bundle/tests/packed-web-command.test.ts
+++ b/packages/agent-bundle/tests/packed-web-command.test.ts
@@ -105,7 +105,7 @@ beforeAll(async () => {
     markdownStream.tarball,
     'react@19.2.8',
     'react-dom@19.2.8',
-    'zod@4.5.4',
+    'zod@4.6.4',
   ], { cwd: project, env: installedEnvironment() });
   const cli = join(project, 'node_modules', '.bin', 'agent-bundle');
   await execFile(cli, ['build', '--root', project, '--output', artifact], {
diff --git a/packages/agent-bundle/tests/prepack.test.ts b/packages/agent-bundle/tests/prepack.test.ts
index f785ae10c..f481bf25c 100644
--- a/packages/agent-bundle/tests/prepack.test.ts
+++ b/packages/agent-bundle/tests/prepack.test.ts
@@ -267,7 +267,7 @@ it('reports package, model, host, and provenance version disagreement as AB7013'
 
 it('reports installed dependencies a consumer never needs as AB7014, per field', () => withPackageDocument(
   (document) => {
-    document.dependencies = { zod: '4.5.4', effect: '4.0.0' };
+    document.dependencies = { zod: '4.6.4', effect: '4.0.0' };
     document.peerDependencies = { react: '19.2.8', 'optional-host': '^1.0.0' };
     document.peerDependenciesMeta = { 'optional-host': { optional: true } };
     document.devDependencies = { 'agent-bundle': 'workspace:*' };
@@ -644,7 +644,7 @@ it('surfaces a warning when the only finding is an unresolvable optional depende
 
 it('accepts a dependency that only packed declaration files reference, including @types for a type directive', () => withPackageDocument(
   (document) => {
-    document.dependencies = { zod: '^4.5.4', '@types/node': '^22.0.0', 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' };
+    document.dependencies = { zod: '^4.6.4', '@types/node': '^22.0.0', 'driver-package': '^1.0.0', 'never-loaded': '^1.0.0' };
     document.imports = { '#driver': { node: 'driver-package/node', default: 'driver-package' } };
   },
   async () => {
diff --git a/packages/agent-bundle/tests/route-invocation-dev-server.test.ts b/packages/agent-bundle/tests/route-invocation-dev-server.test.ts
index 3adea4c91..8709c9dd7 100644
--- a/packages/agent-bundle/tests/route-invocation-dev-server.test.ts
+++ b/packages/agent-bundle/tests/route-invocation-dev-server.test.ts
@@ -125,7 +125,7 @@ it('invokes compiled tool and event routes through the foreground server', { tim
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/aliased.ts': "export const ALIAS_VALUE = 'aliased';\n",
       'src/cli/greet.tsx': [
         "import { Agent } from '@agent-bundle/runtime';",
@@ -1604,7 +1604,7 @@ it('enforces compiled handler, MCP schemas, and operator env across production s
   const project = await createProjectFixture({
     config: "export default { plugin: { name: 'route-parity' }, targets: ['claude'] };\n",
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/events/tool/before.ts': "export default () => ({ outcome: 'deny', reason: 'blocked' });\n",
       'src/events/tool/before.view.tsx': [
         "export default async function BeforeTool() { throw new Error('handler handler ran'); }",
@@ -1747,7 +1747,7 @@ it('publishes invocation routes only after a successful initial or recovered bui
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/mcp/status/tools/report.tsx': [
       "import { defineTool } from 'agent-bundle/routes';",
       "import { Agent } from '@agent-bundle/runtime';",
@@ -1915,7 +1915,7 @@ it('bounds the render history a compiled child produces by count and bytes acros
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       // One Suspense boundary per cell settles per macrotask, so the stream
       // grows one `replace` snapshot at a time; `gate` names a file the last
       // boundary waits for, or `none`.
diff --git a/packages/agent-bundle/tests/trace-dev-server.test.ts b/packages/agent-bundle/tests/trace-dev-server.test.ts
index 0df6d32bd..34a185e3e 100644
--- a/packages/agent-bundle/tests/trace-dev-server.test.ts
+++ b/packages/agent-bundle/tests/trace-dev-server.test.ts
@@ -39,7 +39,7 @@ it('serves replay and live trace entries and lowers build failures', { timeout:
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/events/tool/before.tsx': [
         "import { Agent } from '@agent-bundle/runtime';",
         "import { createElement } from 'react';",
diff --git a/packages/agent-bundle/tests/workbench-surface-dev-server.test.ts b/packages/agent-bundle/tests/workbench-surface-dev-server.test.ts
index ee2fea9e4..1b355b64d 100644
--- a/packages/agent-bundle/tests/workbench-surface-dev-server.test.ts
+++ b/packages/agent-bundle/tests/workbench-surface-dev-server.test.ts
@@ -28,7 +28,7 @@ it('matches the route manifest and lifecycle inventory a real dev server serves'
       '',
     ].join('\n'),
     files: {
-      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module"}\n',
+      'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module"}\n',
       'src/cli/greet.ts': [
         "import { z } from 'zod';",
         '',
diff --git a/packages/create-agent-bundle/templates/cli-tool/package_json b/packages/create-agent-bundle/templates/cli-tool/package_json
index d113cb6d3..09fb26b58 100644
--- a/packages/create-agent-bundle/templates/cli-tool/package_json
+++ b/packages/create-agent-bundle/templates/cli-tool/package_json
@@ -31,6 +31,6 @@
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/packages/create-agent-bundle/templates/mcp-server/package_json b/packages/create-agent-bundle/templates/mcp-server/package_json
index b19a269d3..8f871e223 100644
--- a/packages/create-agent-bundle/templates/mcp-server/package_json
+++ b/packages/create-agent-bundle/templates/mcp-server/package_json
@@ -34,6 +34,6 @@
     "@agent-bundle/runtime": "workspace:*",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/packages/create-agent-bundle/tests/scaffold.test.ts b/packages/create-agent-bundle/tests/scaffold.test.ts
index 5c7989e47..5ab30aa2e 100644
--- a/packages/create-agent-bundle/tests/scaffold.test.ts
+++ b/packages/create-agent-bundle/tests/scaffold.test.ts
@@ -267,7 +267,7 @@ layer(NodeServices.layer, { excludeTestServices: true })('scaffold (real filesys
     expect(cliManifest.devDependencies['@agent-bundle/runtime'])
       .toBe(runtimeSpecForFramework(cliTool.frameworkSpec, testPairing));
     expect(cliManifest.devDependencies['react-dom']).toBe('19.3.0');
-    expect(cliManifest.devDependencies['zod']).toBe('4.5.4');
+    expect(cliManifest.devDependencies['zod']).toBe('4.6.4');
 
     const mcpManifest = yield* readJson<{
       readonly devDependencies: Record<string, string>;
diff --git a/packages/rsc-runtime/package.json b/packages/rsc-runtime/package.json
index ad676e394..b88852c55 100644
--- a/packages/rsc-runtime/package.json
+++ b/packages/rsc-runtime/package.json
@@ -83,7 +83,7 @@
     "@rspack/core": "^2.2.0-0",
     "react": "^19.2.0",
     "react-dom": "^19.2.0",
-    "zod": "^4.5.4"
+    "zod": "^4.6.4"
   },
   "peerDependenciesMeta": {
     "@rspack/core": {
@@ -108,6 +108,6 @@
     "micromark-extension-gfm": "3.0.0",
     "react": "19.3.0",
     "react-dom": "19.3.0",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }
diff --git a/packages/rsc-runtime/tests/manifest-contract.test.ts b/packages/rsc-runtime/tests/manifest-contract.test.ts
index 186f9025d..07531c8eb 100644
--- a/packages/rsc-runtime/tests/manifest-contract.test.ts
+++ b/packages/rsc-runtime/tests/manifest-contract.test.ts
@@ -60,11 +60,11 @@ describe('@agent-bundle/runtime manifest', () => {
     expect(runtimeManifest.dependencies['rsc-markdown-stream']).toBe('workspace:^');
   });
 
-  it('declares zod as a required caret peer at the proven 4.5.4 floor', () => {
-    expect(peers.zod).toBe('^4.5.4');
+  it('declares zod as a required caret peer at the proven 4.6.4 floor', () => {
+    expect(peers.zod).toBe('^4.6.4');
     expect(runtimeManifest.peerDependenciesMeta).not.toHaveProperty('zod');
     expect(runtimeManifest.dependencies).not.toHaveProperty('zod');
-    expect(runtimeManifest.devDependencies.zod).toBe('4.5.4');
+    expect(runtimeManifest.devDependencies.zod).toBe('4.6.4');
   });
 
   it('documents the React contract the manifest declares', async () => {
diff --git a/packages/rsc-runtime/tests/packed-entry-identity.test.ts b/packages/rsc-runtime/tests/packed-entry-identity.test.ts
index f18b5eb70..4da25c048 100644
--- a/packages/rsc-runtime/tests/packed-entry-identity.test.ts
+++ b/packages/rsc-runtime/tests/packed-entry-identity.test.ts
@@ -63,7 +63,7 @@ describe.sequential('packed @agent-bundle/runtime entry identity', () => {
         markdownStream.tarball,
         'react@19.2.8',
         'react-dom@19.2.8',
-        'zod@4.5.4',
+        'zod@4.6.4',
       ], { cwd: consumer, env: installedEnvironment() });
 
       const installed = join(consumer, 'node_modules', '@agent-bundle', 'runtime');
diff --git a/packages/workbench/package.json b/packages/workbench/package.json
index e3ec5f346..3a3ae31b6 100644
--- a/packages/workbench/package.json
+++ b/packages/workbench/package.json
@@ -24,7 +24,7 @@
     "react-markdown": "10.1.0",
     "remark-gfm": "4.0.1",
     "shiki": "4.4.3",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   },
   "devDependencies": {
     "@rsbuild/core": "2.2.5",
diff --git a/packages/workbench/tests/streaming-render.e2e.test.ts b/packages/workbench/tests/streaming-render.e2e.test.ts
index e9a057790..ec711da9a 100644
--- a/packages/workbench/tests/streaming-render.e2e.test.ts
+++ b/packages/workbench/tests/streaming-render.e2e.test.ts
@@ -40,7 +40,7 @@ e2e('renders a compiled MCP tool\'s Suspense fallback before its gated child rel
       ].join('\n'),
       files: {
         ...gatedRouteFiles,
-        'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.5.4"},"type":"module","version":"1.0.0"}\n',
+        'package.json': '{"dependencies":{"@agent-bundle/runtime":"workspace:*","react":"19.2.8","zod":"4.6.4"},"type":"module","version":"1.0.0"}\n',
       },
       prefix: 'agent-bundle-streaming-render-e2e-',
     }),
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1d3ec0ca6..37707af27 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -103,8 +103,8 @@ importers:
         specifier: 19.3.0
         version: 19.3.0
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   examples/hooks-and-scripts:
     devDependencies:
@@ -133,8 +133,8 @@ importers:
         specifier: 19.3.0
         version: 19.3.0
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   examples/mcp-app:
     devDependencies:
@@ -163,8 +163,8 @@ importers:
         specifier: 19.3.0
         version: 19.3.0
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   examples/rsc-agent-runtime:
     dependencies:
@@ -179,7 +179,7 @@ importers:
         version: 2.0.0
       '@modelcontextprotocol/ext-apps':
         specifier: 2.0.0
-        version: 2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.5.4)
+        version: 2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.6.4)
       '@modelcontextprotocol/node':
         specifier: 2.0.0
         version: 2.0.0(@modelcontextprotocol/server@2.0.0)(hono@4.13.3)
@@ -196,8 +196,8 @@ importers:
         specifier: 0.1.0
         version: 0.1.0(@rspack/core@2.2.3(@swc/helpers@0.5.23))(react-dom@19.3.0(react@19.3.0))(react@19.3.0)
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
     devDependencies:
       '@rsbuild/core':
         specifier: 2.2.5
@@ -248,8 +248,8 @@ importers:
         specifier: 19.3.0
         version: 19.3.0
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   packages/agent-bundle:
     dependencies:
@@ -345,8 +345,8 @@ importers:
         specifier: npm:typescript@5.9.3
         version: typescript@5.9.3
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   packages/create-agent-bundle:
     dependencies:
@@ -443,8 +443,8 @@ importers:
         specifier: 19.3.0
         version: 19.3.0(react@19.3.0)
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
   packages/workbench:
     dependencies:
@@ -456,7 +456,7 @@ importers:
         version: 2.0.0
       '@modelcontextprotocol/ext-apps':
         specifier: 2.0.0
-        version: 2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.5.4)
+        version: 2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.6.4)
       '@xterm/addon-fit':
         specifier: 0.11.0
         version: 0.11.0
@@ -482,8 +482,8 @@ importers:
         specifier: 4.4.3
         version: 4.4.3
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
     devDependencies:
       '@rsbuild/core':
         specifier: 2.2.5
@@ -546,8 +546,8 @@ importers:
         specifier: npm:typescript@6.0.3
         version: typescript@6.0.3
       zod:
-        specifier: 4.5.4
-        version: 4.5.4
+        specifier: 4.6.4
+        version: 4.6.4
 
 packages:
 
@@ -3285,8 +3285,8 @@ packages:
     peerDependencies:
       zod: ^3.25.28 || ^4
 
-  zod@4.5.4:
-    resolution: {integrity: sha512-sC95tT5iHHH9gtpj6A81kh+NEaRAUFN+qlUPDUbRfOMvNf5QCBqsb3WgvnpVtK5Y+4UfA6KqufotuTvMGiTlsA==}
+  zod@4.6.4:
+    resolution: {integrity: sha512-AXSD6hvGdvRjajG/l1cC+d6IrhH+sjmPKtYeQdJIK8MFJl3LyClzS+o/YsVC+zQZPupAaeH5skwwm8YqYH7BqA==}
 
   zwitch@2.0.4:
     resolution: {integrity: sha512-bXE4cR/kVZhKZX/RjPEflHaKVhUVl85noU3v6b8apfQEc1x4A+zBxjZ4lN8LqGd6WZ3dl98pY4o717VFmoPp+A==}
@@ -3677,11 +3677,11 @@ snapshots:
       eventsource-parser: 3.1.1
       jose: 6.2.10
       pkce-challenge: 5.0.1
-      zod: 4.5.4
+      zod: 4.6.4
 
   '@modelcontextprotocol/conformance@0.1.16(supports-color@7.2.0)':
     dependencies:
-      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.5.4)
+      '@modelcontextprotocol/sdk': 1.30.0(supports-color@7.2.0)(zod@4.6.4)
       '@octokit/rest': 22.0.1
       commander: 14.0.3
       eventsource-parser: 3.1.1
@@ -3689,21 +3689,21 @@ snapshots:
       jose: 6.2.10
       undici: 7.29.0
       yaml: 2.9.1
-      zod: 4.5.4
+      zod: 4.6.4
     transitivePeerDependencies:
       - '@cfworker/json-schema'
       - supports-color
 
   '@modelcontextprotocol/core@2.0.0':
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.4
 
-  '@modelcontextprotocol/ext-apps@2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.5.4)':
+  '@modelcontextprotocol/ext-apps@2.0.0(@modelcontextprotocol/client@2.0.0)(@modelcontextprotocol/core@2.0.0)(@modelcontextprotocol/server@2.0.0)(react-dom@19.3.0(react@19.3.0))(react@19.3.0)(zod@4.6.4)':
     dependencies:
       '@modelcontextprotocol/client': 2.0.0
       '@modelcontextprotocol/core': 2.0.0
       '@standard-schema/spec': 1.1.0
-      zod: 4.5.4
+      zod: 4.6.4
     optionalDependencies:
       '@modelcontextprotocol/server': 2.0.0
       react: 19.3.0
@@ -3716,7 +3716,7 @@ snapshots:
     optionalDependencies:
       hono: 4.13.3
 
-  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.5.4)':
+  '@modelcontextprotocol/sdk@1.30.0(supports-color@7.2.0)(zod@4.6.4)':
     dependencies:
       '@hono/node-server': 2.1.1(hono@4.13.3)
       ajv: 8.20.0
@@ -3733,15 +3733,15 @@ snapshots:
       json-schema-typed: 8.0.2
       pkce-challenge: 5.0.1
       raw-body: 3.0.2
-      zod: 4.5.4
-      zod-to-json-schema: 3.25.2(zod@4.5.4)
+      zod: 4.6.4
+      zod-to-json-schema: 3.25.2(zod@4.6.4)
     transitivePeerDependencies:
       - supports-color
 
   '@modelcontextprotocol/server@2.0.0':
     dependencies:
       '@modelcontextprotocol/core': 2.0.0
-      zod: 4.5.4
+      zod: 4.6.4
 
   '@msgpackr-extract/msgpackr-extract-darwin-arm64@3.0.4':
     optional: true
@@ -6429,10 +6429,10 @@ snapshots:
 
   yoctocolors@2.2.0: {}
 
-  zod-to-json-schema@3.25.2(zod@4.5.4):
+  zod-to-json-schema@3.25.2(zod@4.6.4):
     dependencies:
-      zod: 4.5.4
+      zod: 4.6.4
 
-  zod@4.5.4: {}
+  zod@4.6.4: {}
 
   zwitch@2.0.4: {}
diff --git a/website/docs/en/guide/start/installation.mdx b/website/docs/en/guide/start/installation.mdx
index 9c4046c9d..49aff3ed2 100644
--- a/website/docs/en/guide/start/installation.mdx
+++ b/website/docs/en/guide/start/installation.mdx
@@ -70,13 +70,13 @@ pair without preinstalling React or bypassing peer checks. Routed scaffolds stil
 known-good React/React DOM pair intentionally: generated projects start reproducibly, and their
 committed lockfiles preserve that pair.
 
-`@agent-bundle/runtime` declares `zod` as a `^4.5.4` peer rather than a dependency for the same
+`@agent-bundle/runtime` declares `zod` as a `^4.6.4` peer rather than a dependency for the same
 reason: route and state definitions hand Zod schemas across the runtime's API, and Zod 4 brands
 schema types by minor version. A nested `zod@4.5.x` therefore rejects a consumer schema from
 `zod@4.6.x` (`Type '6' is not assignable to type '5'`). Two installations of the same minor
 still typecheck; the peer is so the project and the runtime resolve one copy and stay on
-compatible minors. Existing projects still pinned to `zod@4.4.3`, or any version below
-`4.5.4`, must upgrade that direct dependency before installing this runtime, npm otherwise
+compatible minors. Existing projects still pinned to `zod@4.5.x`, or any version below
+`4.6.4`, must upgrade that direct dependency before installing this runtime, npm otherwise
 rejects the required peer with `ERESOLVE`.
 
 ## Pin a Version Packages commit
diff --git a/website/docs/zh/guide/start/installation.mdx b/website/docs/zh/guide/start/installation.mdx
index 99b8eeff5..b9190605a 100644
--- a/website/docs/zh/guide/start/installation.mdx
+++ b/website/docs/zh/guide/start/installation.mdx
@@ -64,11 +64,11 @@ React 和 React DOM 声明同一个范围，因此全新的 npm 安装可以选
 React，也无需绕过 peer 检查。路由式脚手架仍会有意固定一组已验证的 React/React DOM 版本：
 生成的项目由此保持可复现，提交后的 lockfile 会继续保留这组版本。
 
-出于同样的原因，`@agent-bundle/runtime` 将 `zod` 声明为 `^4.5.4` peer 依赖而非普通依赖：路由和
+出于同样的原因，`@agent-bundle/runtime` 将 `zod` 声明为 `^4.6.4` peer 依赖而非普通依赖：路由和
 状态定义会把 Zod schema 传过 runtime 的 API，而 Zod 4 会按 minor 版本给 schema 类型打标记。
 因此嵌套的 `zod@4.5.x` 无法接受来自 `zod@4.6.x` 的消费方 schema（`Type '6' is not assignable
 to type '5'`）。同一 minor 的两份安装仍能通过类型检查；peer 的作用是让项目与 runtime 解析到
-同一份副本，并停留在兼容的 minor 上。仍将直接依赖固定在 `zod@4.4.3`、或任何低于 `4.5.4`
+同一份副本，并停留在兼容的 minor 上。仍将直接依赖固定在 `zod@4.5.x`、或任何低于 `4.6.4`
 的版本的现有项目，必须先升级该依赖再安装此 runtime，否则 npm 会以 `ERESOLVE` 拒绝所需的
 peer。
 
diff --git a/website/package.json b/website/package.json
index 9220cd313..985cefe33 100644
--- a/website/package.json
+++ b/website/package.json
@@ -32,6 +32,6 @@
     "react-dom": "19.3.0",
     "typescript": "7.0.2",
     "typescript-6": "npm:typescript@6.0.3",
-    "zod": "4.5.4"
+    "zod": "4.6.4"
   }
 }