diff --git a/Cargo.Bazel.json.lock b/Cargo.Bazel.json.lock
index 64854ffd81ea..4a897cd461fc 100644
--- a/Cargo.Bazel.json.lock
+++ b/Cargo.Bazel.json.lock
@@ -1,5 +1,5 @@
 {
-  "checksum": "ec22472b8c37952cd16623fb019e126dc293d9ee4f573aeffcb6af5332790ce7",
+  "checksum": "583b929490b0268c8b59be79a27553bf5c3d2ac2df2b4be8ca494c8bf6a1d91b",
   "crates": {
     "abnf 0.12.0": {
       "name": "abnf",
@@ -12064,6 +12064,137 @@
       ],
       "license_file": "LICENSE"
     },
+    "candid_parser 0.2.4": {
+      "name": "candid_parser",
+      "version": "0.2.4",
+      "package_url": "https://github.com/dfinity/candid",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/candid_parser/0.2.4/download",
+          "sha256": "75daa0ef508c92f38dd0eaaaae7d13f317b68ab73c875068257348574a6bcce2"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "candid_parser",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        },
+        {
+          "BuildScript": {
+            "crate_name": "build_script_build",
+            "crate_root": "build.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "candid_parser",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "anyhow 1.0.100",
+              "target": "anyhow"
+            },
+            {
+              "id": "candid 0.10.22",
+              "target": "candid"
+            },
+            {
+              "id": "candid_parser 0.2.4",
+              "target": "build_script_build"
+            },
+            {
+              "id": "codespan-reporting 0.11.1",
+              "target": "codespan_reporting"
+            },
+            {
+              "id": "convert_case 0.6.0",
+              "target": "convert_case"
+            },
+            {
+              "id": "handlebars 6.4.0",
+              "target": "handlebars"
+            },
+            {
+              "id": "hex 0.4.3",
+              "target": "hex"
+            },
+            {
+              "id": "lalrpop-util 0.20.0",
+              "target": "lalrpop_util"
+            },
+            {
+              "id": "logos 0.14.4",
+              "target": "logos"
+            },
+            {
+              "id": "num-bigint 0.4.6",
+              "target": "num_bigint"
+            },
+            {
+              "id": "pretty 0.12.1",
+              "target": "pretty"
+            },
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            },
+            {
+              "id": "thiserror 1.0.68",
+              "target": "thiserror"
+            },
+            {
+              "id": "toml 0.8.19",
+              "target": "toml"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.2.4"
+      },
+      "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "compile_data_glob_excludes": [
+          "**/*.rs"
+        ],
+        "data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "lalrpop 0.20.0",
+              "target": "lalrpop"
+            }
+          ],
+          "selects": {}
+        }
+      },
+      "license": "Apache-2.0",
+      "license_ids": [
+        "Apache-2.0"
+      ],
+      "license_file": "LICENSE"
+    },
     "canlog 0.2.0": {
       "name": "canlog",
       "version": "0.2.0",
@@ -20584,6 +20715,185 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
+    "derive_builder 0.20.2": {
+      "name": "derive_builder",
+      "version": "0.20.2",
+      "package_url": "https://github.com/colin-kiegel/rust-derive-builder",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/derive_builder/0.20.2/download",
+          "sha256": "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "derive_builder",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "derive_builder",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "default",
+            "std"
+          ],
+          "selects": {}
+        },
+        "edition": "2018",
+        "proc_macro_deps": {
+          "common": [
+            {
+              "id": "derive_builder_macro 0.20.2",
+              "target": "derive_builder_macro"
+            }
+          ],
+          "selects": {}
+        },
+        "version": "0.20.2"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
+    "derive_builder_core 0.20.2": {
+      "name": "derive_builder_core",
+      "version": "0.20.2",
+      "package_url": "https://github.com/colin-kiegel/rust-derive-builder",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/derive_builder_core/0.20.2/download",
+          "sha256": "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "derive_builder_core",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "derive_builder_core",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "lib_has_std"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "darling 0.20.11",
+              "target": "darling"
+            },
+            {
+              "id": "proc-macro2 1.0.103",
+              "target": "proc_macro2"
+            },
+            {
+              "id": "quote 1.0.42",
+              "target": "quote"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2018",
+        "version": "0.20.2"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
+    "derive_builder_macro 0.20.2": {
+      "name": "derive_builder_macro",
+      "version": "0.20.2",
+      "package_url": "https://github.com/colin-kiegel/rust-derive-builder",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/derive_builder_macro/0.20.2/download",
+          "sha256": "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+        }
+      },
+      "targets": [
+        {
+          "ProcMacro": {
+            "crate_name": "derive_builder_macro",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "derive_builder_macro",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "lib_has_std"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "derive_builder_core 0.20.2",
+              "target": "derive_builder_core"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2018",
+        "version": "0.20.2"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "derive_more 0.99.17": {
       "name": "derive_more",
       "version": "0.99.17",
@@ -21948,7 +22258,7 @@
               "target": "ic_vetkeys"
             },
             {
-              "id": "ic-wasm 0.8.4",
+              "id": "ic-wasm 0.9.11",
               "target": "ic_wasm"
             },
             {
@@ -31119,6 +31429,92 @@
       ],
       "license_file": "LICENSE"
     },
+    "handlebars 6.4.0": {
+      "name": "handlebars",
+      "version": "6.4.0",
+      "package_url": "https://github.com/sunng87/handlebars-rust",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/handlebars/6.4.0/download",
+          "sha256": "9b3f9296c208515b87bd915a2f5d1163d4b3f863ba83337d7713cf478055948e"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "handlebars",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "handlebars",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "default"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "derive_builder 0.20.2",
+              "target": "derive_builder"
+            },
+            {
+              "id": "log 0.4.28",
+              "target": "log"
+            },
+            {
+              "id": "num-order 1.2.0",
+              "target": "num_order"
+            },
+            {
+              "id": "pest 2.7.1",
+              "target": "pest"
+            },
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            },
+            {
+              "id": "serde_json 1.0.145",
+              "target": "serde_json"
+            },
+            {
+              "id": "thiserror 2.0.18",
+              "target": "thiserror"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "proc_macro_deps": {
+          "common": [
+            {
+              "id": "pest_derive 2.7.1",
+              "target": "pest_derive"
+            }
+          ],
+          "selects": {}
+        },
+        "version": "6.4.0"
+      },
+      "license": "MIT",
+      "license_ids": [
+        "MIT"
+      ],
+      "license_file": "LICENSE"
+    },
     "hardware-address 0.2.0": {
       "name": "hardware-address",
       "version": "0.2.0",
@@ -31908,54 +32304,6 @@
       ],
       "license_file": "LICENSE"
     },
-    "heck 0.3.3": {
-      "name": "heck",
-      "version": "0.3.3",
-      "package_url": "https://github.com/withoutboats/heck",
-      "repository": {
-        "Http": {
-          "url": "https://static.crates.io/crates/heck/0.3.3/download",
-          "sha256": "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-        }
-      },
-      "targets": [
-        {
-          "Library": {
-            "crate_name": "heck",
-            "crate_root": "src/lib.rs",
-            "srcs": {
-              "allow_empty": true,
-              "include": [
-                "**/*.rs"
-              ]
-            }
-          }
-        }
-      ],
-      "library_target_name": "heck",
-      "common_attrs": {
-        "compile_data_glob": [
-          "**"
-        ],
-        "deps": {
-          "common": [
-            {
-              "id": "unicode-segmentation 1.12.0",
-              "target": "unicode_segmentation"
-            }
-          ],
-          "selects": {}
-        },
-        "edition": "2018",
-        "version": "0.3.3"
-      },
-      "license": "MIT OR Apache-2.0",
-      "license_ids": [
-        "Apache-2.0",
-        "MIT"
-      ],
-      "license_file": "LICENSE-APACHE"
-    },
     "heck 0.4.1": {
       "name": "heck",
       "version": "0.4.1",
@@ -38509,14 +38857,14 @@
       ],
       "license_file": "LICENSE"
     },
-    "ic-wasm 0.8.4": {
+    "ic-wasm 0.9.11": {
       "name": "ic-wasm",
-      "version": "0.8.4",
+      "version": "0.9.11",
       "package_url": "https://github.com/dfinity/ic-wasm",
       "repository": {
         "Http": {
-          "url": "https://static.crates.io/crates/ic-wasm/0.8.4/download",
-          "sha256": "45bc33855672981ae4a2f4e77c1a77d1bdc0756fb1b36ad0dbe47df77a955e2d"
+          "url": "https://static.crates.io/crates/ic-wasm/0.9.11/download",
+          "sha256": "04a4c6c1f1f7a2126be36fe51cdbc1c8991214f231811dca7ec1971d15cb6f91"
         }
       },
       "targets": [
@@ -38552,10 +38900,8 @@
         ],
         "crate_features": {
           "common": [
-            "anyhow",
-            "clap",
-            "exe",
-            "serde"
+            "check-endpoints",
+            "exe"
           ],
           "selects": {}
         },
@@ -38569,6 +38915,10 @@
               "id": "candid 0.10.22",
               "target": "candid"
             },
+            {
+              "id": "candid_parser 0.2.4",
+              "target": "candid_parser"
+            },
             {
               "id": "clap 4.5.53",
               "target": "clap"
@@ -38577,6 +38927,10 @@
               "id": "libflate 2.1.0",
               "target": "libflate"
             },
+            {
+              "id": "parse-display 0.10.0",
+              "target": "parse_display"
+            },
             {
               "id": "rustc-demangle 0.1.26",
               "target": "rustc_demangle"
@@ -38594,14 +38948,18 @@
               "target": "thiserror"
             },
             {
-              "id": "walrus 0.21.1",
+              "id": "walrus 0.22.0",
               "target": "walrus"
+            },
+            {
+              "id": "wasmparser 0.223.1",
+              "target": "wasmparser"
             }
           ],
           "selects": {}
         },
         "edition": "2021",
-        "version": "0.8.4"
+        "version": "0.9.11"
       },
       "license": "Apache-2.0",
       "license_ids": [
@@ -46747,6 +47105,63 @@
       ],
       "license_file": null
     },
+    "logos 0.14.4": {
+      "name": "logos",
+      "version": "0.14.4",
+      "package_url": "https://github.com/maciejhirsz/logos",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/logos/0.14.4/download",
+          "sha256": "7251356ef8cb7aec833ddf598c6cb24d17b689d20b993f9d11a3d764e34e6458"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "logos",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "logos",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "default",
+            "export_derive",
+            "logos-derive",
+            "std"
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "proc_macro_deps": {
+          "common": [
+            {
+              "id": "logos-derive 0.14.4",
+              "target": "logos_derive"
+            }
+          ],
+          "selects": {}
+        },
+        "version": "0.14.4"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "logos-codegen 0.13.0": {
       "name": "logos-codegen",
       "version": "0.13.0",
@@ -46815,6 +47230,78 @@
       ],
       "license_file": null
     },
+    "logos-codegen 0.14.4": {
+      "name": "logos-codegen",
+      "version": "0.14.4",
+      "package_url": "https://github.com/maciejhirsz/logos",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/logos-codegen/0.14.4/download",
+          "sha256": "59f80069600c0d66734f5ff52cc42f2dabd6b29d205f333d61fd7832e9e9963f"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "logos_codegen",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "logos_codegen",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "beef 0.5.2",
+              "target": "beef"
+            },
+            {
+              "id": "fnv 1.0.7",
+              "target": "fnv"
+            },
+            {
+              "id": "lazy_static 1.5.0",
+              "target": "lazy_static"
+            },
+            {
+              "id": "proc-macro2 1.0.103",
+              "target": "proc_macro2"
+            },
+            {
+              "id": "quote 1.0.42",
+              "target": "quote"
+            },
+            {
+              "id": "regex-syntax 0.8.5",
+              "target": "regex_syntax"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.14.4"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "logos-derive 0.12.1": {
       "name": "logos-derive",
       "version": "0.12.1",
@@ -46931,6 +47418,54 @@
       ],
       "license_file": null
     },
+    "logos-derive 0.14.4": {
+      "name": "logos-derive",
+      "version": "0.14.4",
+      "package_url": "https://github.com/maciejhirsz/logos",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/logos-derive/0.14.4/download",
+          "sha256": "24fb722b06a9dc12adb0963ed585f19fc61dc5413e6a9be9422ef92c091e731d"
+        }
+      },
+      "targets": [
+        {
+          "ProcMacro": {
+            "crate_name": "logos_derive",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "logos_derive",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "logos-codegen 0.14.4",
+              "target": "logos_codegen"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.14.4"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "loopdev-3 0.5.1": {
       "name": "loopdev-3",
       "version": "0.5.1",
@@ -51926,6 +52461,97 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
+    "num-modular 0.6.1": {
+      "name": "num-modular",
+      "version": "0.6.1",
+      "package_url": "https://github.com/cmpute/num-modular",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/num-modular/0.6.1/download",
+          "sha256": "17bb261bf36fa7d83f4c294f834e91256769097b3cb505d44831e0a179ac647f"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "num_modular",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "num_modular",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "edition": "2018",
+        "version": "0.6.1"
+      },
+      "license": "Apache-2.0",
+      "license_ids": [
+        "Apache-2.0"
+      ],
+      "license_file": "LICENSE"
+    },
+    "num-order 1.2.0": {
+      "name": "num-order",
+      "version": "1.2.0",
+      "package_url": "https://github.com/cmpute/num-order",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/num-order/1.2.0/download",
+          "sha256": "537b596b97c40fcf8056d153049eb22f481c17ebce72a513ec9286e4986d1bb6"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "num_order",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "num_order",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "default"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "num-modular 0.6.1",
+              "target": "num_modular"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2018",
+        "version": "1.2.0"
+      },
+      "license": "Apache-2.0",
+      "license_ids": [
+        "Apache-2.0"
+      ],
+      "license_file": "LICENSE"
+    },
     "num-rational 0.4.2": {
       "name": "num-rational",
       "version": "0.4.2",
@@ -55586,6 +56212,144 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
+    "parse-display 0.10.0": {
+      "name": "parse-display",
+      "version": "0.10.0",
+      "package_url": "https://github.com/frozenlib/parse-display",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/parse-display/0.10.0/download",
+          "sha256": "287d8d3ebdce117b8539f59411e4ed9ec226e0a4153c7f55495c6070d68e6f72"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "parse_display",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "parse_display",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "default",
+            "regex",
+            "regex-syntax",
+            "std"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "regex 1.12.2",
+              "target": "regex"
+            },
+            {
+              "id": "regex-syntax 0.8.5",
+              "target": "regex_syntax"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "proc_macro_deps": {
+          "common": [
+            {
+              "id": "parse-display-derive 0.10.0",
+              "target": "parse_display_derive"
+            }
+          ],
+          "selects": {}
+        },
+        "version": "0.10.0"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": null
+    },
+    "parse-display-derive 0.10.0": {
+      "name": "parse-display-derive",
+      "version": "0.10.0",
+      "package_url": "https://github.com/frozenlib/parse-display",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/parse-display-derive/0.10.0/download",
+          "sha256": "7fc048687be30d79502dea2f623d052f3a074012c6eac41726b7ab17213616b1"
+        }
+      },
+      "targets": [
+        {
+          "ProcMacro": {
+            "crate_name": "parse_display_derive",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "parse_display_derive",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "proc-macro2 1.0.103",
+              "target": "proc_macro2"
+            },
+            {
+              "id": "quote 1.0.42",
+              "target": "quote"
+            },
+            {
+              "id": "regex 1.12.2",
+              "target": "regex"
+            },
+            {
+              "id": "regex-syntax 0.8.5",
+              "target": "regex_syntax"
+            },
+            {
+              "id": "structmeta 0.3.0",
+              "target": "structmeta"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.10.0"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": null
+    },
     "parse-size 1.1.0": {
       "name": "parse-size",
       "version": "1.1.0",
@@ -73341,6 +74105,60 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
+    "serde_spanned 0.6.9": {
+      "name": "serde_spanned",
+      "version": "0.6.9",
+      "package_url": "https://github.com/toml-rs/toml",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/serde_spanned/0.6.9/download",
+          "sha256": "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "serde_spanned",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "serde_spanned",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "serde"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.6.9"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "serde_urlencoded 0.7.1": {
       "name": "serde_urlencoded",
       "version": "0.7.1",
@@ -77775,6 +78593,71 @@
       ],
       "license_file": null
     },
+    "structmeta 0.3.0": {
+      "name": "structmeta",
+      "version": "0.3.0",
+      "package_url": "https://github.com/frozenlib/structmeta",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/structmeta/0.3.0/download",
+          "sha256": "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "structmeta",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "structmeta",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "proc-macro2 1.0.103",
+              "target": "proc_macro2"
+            },
+            {
+              "id": "quote 1.0.42",
+              "target": "quote"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "proc_macro_deps": {
+          "common": [
+            {
+              "id": "structmeta-derive 0.3.0",
+              "target": "structmeta_derive"
+            }
+          ],
+          "selects": {}
+        },
+        "version": "0.3.0"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": null
+    },
     "structmeta-derive 0.2.0": {
       "name": "structmeta-derive",
       "version": "0.2.0",
@@ -77831,6 +78714,62 @@
       ],
       "license_file": null
     },
+    "structmeta-derive 0.3.0": {
+      "name": "structmeta-derive",
+      "version": "0.3.0",
+      "package_url": "https://github.com/frozenlib/structmeta",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/structmeta-derive/0.3.0/download",
+          "sha256": "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+        }
+      },
+      "targets": [
+        {
+          "ProcMacro": {
+            "crate_name": "structmeta_derive",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "structmeta_derive",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "deps": {
+          "common": [
+            {
+              "id": "proc-macro2 1.0.103",
+              "target": "proc_macro2"
+            },
+            {
+              "id": "quote 1.0.42",
+              "target": "quote"
+            },
+            {
+              "id": "syn 2.0.110",
+              "target": "syn"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.3.0"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": null
+    },
     "strum 0.25.0": {
       "name": "strum",
       "version": "0.25.0",
@@ -83327,6 +84266,72 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
+    "toml 0.8.19": {
+      "name": "toml",
+      "version": "0.8.19",
+      "package_url": "https://github.com/toml-rs/toml",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/toml/0.8.19/download",
+          "sha256": "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "toml",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "toml",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "parse"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            },
+            {
+              "id": "serde_spanned 0.6.9",
+              "target": "serde_spanned"
+            },
+            {
+              "id": "toml_datetime 0.6.8",
+              "target": "toml_datetime"
+            },
+            {
+              "id": "toml_edit 0.22.20",
+              "target": "toml_edit"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.8.19"
+      },
+      "license": "MIT OR Apache-2.0",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": "LICENSE-APACHE"
+    },
     "toml_datetime 0.6.8": {
       "name": "toml_datetime",
       "version": "0.6.8",
@@ -83356,6 +84361,21 @@
         "compile_data_glob": [
           "**"
         ],
+        "crate_features": {
+          "common": [
+            "serde"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            }
+          ],
+          "selects": {}
+        },
         "edition": "2021",
         "version": "0.6.8"
       },
@@ -83459,11 +84479,27 @@
         ],
         "crate_features": {
           "common": [
-            "default",
-            "display",
-            "parse"
+            "parse",
+            "serde"
           ],
-          "selects": {}
+          "selects": {
+            "aarch64-apple-darwin": [
+              "default",
+              "display"
+            ],
+            "aarch64-unknown-linux-gnu": [
+              "default",
+              "display"
+            ],
+            "x86_64-apple-darwin": [
+              "default",
+              "display"
+            ],
+            "x86_64-unknown-linux-gnu": [
+              "default",
+              "display"
+            ]
+          }
         },
         "deps": {
           "common": [
@@ -83471,6 +84507,14 @@
               "id": "indexmap 2.14.0",
               "target": "indexmap"
             },
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            },
+            {
+              "id": "serde_spanned 0.6.9",
+              "target": "serde_spanned"
+            },
             {
               "id": "toml_datetime 0.6.8",
               "target": "toml_datetime"
@@ -88614,14 +89658,14 @@
       ],
       "license_file": "LICENSE-MIT"
     },
-    "walrus 0.21.1": {
+    "walrus 0.22.0": {
       "name": "walrus",
-      "version": "0.21.1",
+      "version": "0.22.0",
       "package_url": "https://github.com/rustwasm/walrus",
       "repository": {
         "Http": {
-          "url": "https://static.crates.io/crates/walrus/0.21.1/download",
-          "sha256": "467611cafbc8a84834b77d2b4bb191fd2f5769752def8340407e924390c6883b"
+          "url": "https://static.crates.io/crates/walrus/0.22.0/download",
+          "sha256": "d68aa3c7b80be75c8458fc087453e5a31a226cfffede2e9b932393b2ea1c624a"
         }
       },
       "targets": [
@@ -88680,13 +89724,13 @@
         "proc_macro_deps": {
           "common": [
             {
-              "id": "walrus-macro 0.19.0",
+              "id": "walrus-macro 0.22.0",
               "target": "walrus_macro"
             }
           ],
           "selects": {}
         },
-        "version": "0.21.1"
+        "version": "0.22.0"
       },
       "license": "MIT/Apache-2.0",
       "license_ids": [
@@ -88776,66 +89820,6 @@
       ],
       "license_file": "LICENSE-APACHE"
     },
-    "walrus-macro 0.19.0": {
-      "name": "walrus-macro",
-      "version": "0.19.0",
-      "package_url": "https://github.com/rustwasm/walrus/tree/crates/macro",
-      "repository": {
-        "Http": {
-          "url": "https://static.crates.io/crates/walrus-macro/0.19.0/download",
-          "sha256": "0a6e5bd22c71e77d60140b0bd5be56155a37e5bd14e24f5f87298040d0cc40d7"
-        }
-      },
-      "targets": [
-        {
-          "ProcMacro": {
-            "crate_name": "walrus_macro",
-            "crate_root": "src/lib.rs",
-            "srcs": {
-              "allow_empty": true,
-              "include": [
-                "**/*.rs"
-              ]
-            }
-          }
-        }
-      ],
-      "library_target_name": "walrus_macro",
-      "common_attrs": {
-        "compile_data_glob": [
-          "**"
-        ],
-        "deps": {
-          "common": [
-            {
-              "id": "heck 0.3.3",
-              "target": "heck"
-            },
-            {
-              "id": "proc-macro2 1.0.103",
-              "target": "proc_macro2"
-            },
-            {
-              "id": "quote 1.0.42",
-              "target": "quote"
-            },
-            {
-              "id": "syn 1.0.109",
-              "target": "syn"
-            }
-          ],
-          "selects": {}
-        },
-        "edition": "2018",
-        "version": "0.19.0"
-      },
-      "license": "MIT/Apache-2.0",
-      "license_ids": [
-        "Apache-2.0",
-        "MIT"
-      ],
-      "license_file": "LICENSE-APACHE"
-    },
     "walrus-macro 0.22.0": {
       "name": "walrus-macro",
       "version": "0.22.0",
@@ -90160,6 +91144,110 @@
       ],
       "license_file": null
     },
+    "wasmparser 0.223.1": {
+      "name": "wasmparser",
+      "version": "0.223.1",
+      "package_url": "https://github.com/bytecodealliance/wasm-tools/tree/main/crates/wasmparser",
+      "repository": {
+        "Http": {
+          "url": "https://static.crates.io/crates/wasmparser/0.223.1/download",
+          "sha256": "664b980991ed9a8c834eb528a8979ab1109edcf52dc05dd5751e2cc3fb31035d"
+        }
+      },
+      "targets": [
+        {
+          "Library": {
+            "crate_name": "wasmparser",
+            "crate_root": "src/lib.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        },
+        {
+          "BuildScript": {
+            "crate_name": "build_script_build",
+            "crate_root": "build.rs",
+            "srcs": {
+              "allow_empty": true,
+              "include": [
+                "**/*.rs"
+              ]
+            }
+          }
+        }
+      ],
+      "library_target_name": "wasmparser",
+      "common_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "crate_features": {
+          "common": [
+            "component-model",
+            "default",
+            "features",
+            "hash-collections",
+            "serde",
+            "simd",
+            "std",
+            "validate"
+          ],
+          "selects": {}
+        },
+        "deps": {
+          "common": [
+            {
+              "id": "bitflags 2.10.0",
+              "target": "bitflags"
+            },
+            {
+              "id": "hashbrown 0.15.2",
+              "target": "hashbrown"
+            },
+            {
+              "id": "indexmap 2.14.0",
+              "target": "indexmap"
+            },
+            {
+              "id": "semver 1.0.27",
+              "target": "semver"
+            },
+            {
+              "id": "serde 1.0.228",
+              "target": "serde"
+            },
+            {
+              "id": "wasmparser 0.223.1",
+              "target": "build_script_build"
+            }
+          ],
+          "selects": {}
+        },
+        "edition": "2021",
+        "version": "0.223.1"
+      },
+      "build_script_attrs": {
+        "compile_data_glob": [
+          "**"
+        ],
+        "compile_data_glob_excludes": [
+          "**/*.rs"
+        ],
+        "data_glob": [
+          "**"
+        ]
+      },
+      "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT",
+      "license_ids": [
+        "Apache-2.0",
+        "MIT"
+      ],
+      "license_file": null
+    },
     "wasmparser 0.235.0": {
       "name": "wasmparser",
       "version": "0.235.0",
@@ -98627,7 +99715,7 @@
   },
   "binary_crates": [
     "canbench 0.4.1",
-    "ic-wasm 0.8.4",
+    "ic-wasm 0.9.11",
     "metrics-proxy 0.1.0"
   ],
   "workspace_members": {
@@ -99075,7 +100163,7 @@
     "ic-utils 0.45.0",
     "ic-verify-bls-signature 0.6.0",
     "ic-vetkeys 0.6.0",
-    "ic-wasm 0.8.4",
+    "ic-wasm 0.9.11",
     "ic-xrc-types 1.2.0",
     "ic0 1.0.1",
     "ic_bls12_381 0.10.1",
diff --git a/Cargo.Bazel.toml.lock b/Cargo.Bazel.toml.lock
index 22bd9e3815d8..538871e1fb3e 100644
--- a/Cargo.Bazel.toml.lock
+++ b/Cargo.Bazel.toml.lock
@@ -2060,6 +2060,28 @@ dependencies = [
  "thiserror 1.0.68",
 ]
 
+[[package]]
+name = "candid_parser"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75daa0ef508c92f38dd0eaaaae7d13f317b68ab73c875068257348574a6bcce2"
+dependencies = [
+ "anyhow",
+ "candid",
+ "codespan-reporting",
+ "convert_case 0.6.0",
+ "handlebars 6.4.0",
+ "hex",
+ "lalrpop 0.20.0",
+ "lalrpop-util 0.20.0",
+ "logos 0.14.4",
+ "num-bigint 0.4.6",
+ "pretty 0.12.1",
+ "serde",
+ "thiserror 1.0.68",
+ "toml 0.8.19",
+]
+
 [[package]]
 name = "canlog"
 version = "0.2.0"
@@ -3486,6 +3508,37 @@ dependencies = [
  "syn 2.0.110",
 ]
 
+[[package]]
+name = "derive_builder"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "507dfb09ea8b7fa618fcf76e953f4f5e192547945816d5358edffe39f6f94947"
+dependencies = [
+ "derive_builder_macro",
+]
+
+[[package]]
+name = "derive_builder_core"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2d5bcf7b024d6835cfb3d473887cd966994907effbe9227e8c8219824d06c4e8"
+dependencies = [
+ "darling 0.20.11",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]
+
+[[package]]
+name = "derive_builder_macro"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab63b0e2bf4d5928aff72e83a7dace85d7bba5fe12dcc3c5a572d78caffd3f3c"
+dependencies = [
+ "derive_builder_core",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "derive_more"
 version = "0.99.17"
@@ -3545,7 +3598,7 @@ dependencies = [
  "directories-next",
  "dunce",
  "flate2",
- "handlebars",
+ "handlebars 4.5.0",
  "hex",
  "humantime-serde",
  "ic-agent",
@@ -3665,7 +3718,7 @@ dependencies = [
  "canbench",
  "canbench-rs",
  "candid",
- "candid_parser",
+ "candid_parser 0.1.4",
  "cargo_metadata",
  "cc",
  "cddl",
@@ -3960,7 +4013,7 @@ dependencies = [
  "tokio-test",
  "tokio-tungstenite 0.26.2",
  "tokio-util",
- "toml",
+ "toml 0.5.11",
  "tonic 0.12.3",
  "tonic-build",
  "tower 0.5.2",
@@ -5363,6 +5416,22 @@ dependencies = [
  "thiserror 1.0.68",
 ]
 
+[[package]]
+name = "handlebars"
+version = "6.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b3f9296c208515b87bd915a2f5d1163d4b3f863ba83337d7713cf478055948e"
+dependencies = [
+ "derive_builder",
+ "log",
+ "num-order",
+ "pest",
+ "pest_derive",
+ "serde",
+ "serde_json",
+ "thiserror 2.0.18",
+]
+
 [[package]]
 name = "hardware-address"
 version = "0.2.0"
@@ -5506,15 +5575,6 @@ dependencies = [
  "http 1.3.1",
 ]
 
-[[package]]
-name = "heck"
-version = "0.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6d621efb26863f0e9924c6ac577e8275e5e6b77455db64ffa6c65c904e9e132c"
-dependencies = [
- "unicode-segmentation",
-]
-
 [[package]]
 name = "heck"
 version = "0.4.1"
@@ -6759,19 +6819,22 @@ dependencies = [
 
 [[package]]
 name = "ic-wasm"
-version = "0.8.4"
+version = "0.9.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "45bc33855672981ae4a2f4e77c1a77d1bdc0756fb1b36ad0dbe47df77a955e2d"
+checksum = "04a4c6c1f1f7a2126be36fe51cdbc1c8991214f231811dca7ec1971d15cb6f91"
 dependencies = [
  "anyhow",
  "candid",
+ "candid_parser 0.2.4",
  "clap 4.5.53",
  "libflate",
+ "parse-display",
  "rustc-demangle",
  "serde",
  "serde_json",
  "thiserror 1.0.68",
- "walrus 0.21.1",
+ "walrus 0.22.0",
+ "wasmparser 0.223.1",
 ]
 
 [[package]]
@@ -8085,6 +8148,15 @@ dependencies = [
  "logos-derive 0.13.0",
 ]
 
+[[package]]
+name = "logos"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7251356ef8cb7aec833ddf598c6cb24d17b689d20b993f9d11a3d764e34e6458"
+dependencies = [
+ "logos-derive 0.14.4",
+]
+
 [[package]]
 name = "logos-codegen"
 version = "0.13.0"
@@ -8099,6 +8171,21 @@ dependencies = [
  "syn 2.0.110",
 ]
 
+[[package]]
+name = "logos-codegen"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59f80069600c0d66734f5ff52cc42f2dabd6b29d205f333d61fd7832e9e9963f"
+dependencies = [
+ "beef",
+ "fnv",
+ "lazy_static",
+ "proc-macro2",
+ "quote",
+ "regex-syntax 0.8.5",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "logos-derive"
 version = "0.12.1"
@@ -8119,7 +8206,16 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dbfc0d229f1f42d790440136d941afd806bc9e949e2bcb8faa813b0f00d1267e"
 dependencies = [
- "logos-codegen",
+ "logos-codegen 0.13.0",
+]
+
+[[package]]
+name = "logos-derive"
+version = "0.14.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24fb722b06a9dc12adb0963ed585f19fc61dc5413e6a9be9422ef92c091e731d"
+dependencies = [
+ "logos-codegen 0.14.4",
 ]
 
 [[package]]
@@ -8895,6 +8991,21 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "num-modular"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "17bb261bf36fa7d83f4c294f834e91256769097b3cb505d44831e0a179ac647f"
+
+[[package]]
+name = "num-order"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "537b596b97c40fcf8056d153049eb22f481c17ebce72a513ec9286e4986d1bb6"
+dependencies = [
+ "num-modular",
+]
+
 [[package]]
 name = "num-rational"
 version = "0.4.2"
@@ -9475,6 +9586,31 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
+[[package]]
+name = "parse-display"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "287d8d3ebdce117b8539f59411e4ed9ec226e0a4153c7f55495c6070d68e6f72"
+dependencies = [
+ "parse-display-derive",
+ "regex",
+ "regex-syntax 0.8.5",
+]
+
+[[package]]
+name = "parse-display-derive"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7fc048687be30d79502dea2f623d052f3a074012c6eac41726b7ab17213616b1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "regex",
+ "regex-syntax 0.8.5",
+ "structmeta 0.3.0",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "parse-size"
 version = "1.1.0"
@@ -12341,6 +12477,15 @@ dependencies = [
  "syn 2.0.110",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "serde_urlencoded"
 version = "0.7.1"
@@ -13087,7 +13232,19 @@ checksum = "78ad9e09554f0456d67a69c1584c9798ba733a5b50349a6c0d0948710523922d"
 dependencies = [
  "proc-macro2",
  "quote",
- "structmeta-derive",
+ "structmeta-derive 0.2.0",
+ "syn 2.0.110",
+]
+
+[[package]]
+name = "structmeta"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e1575d8d40908d70f6fd05537266b90ae71b15dbbe7a8b7dffa2b759306d329"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "structmeta-derive 0.3.0",
  "syn 2.0.110",
 ]
 
@@ -13102,6 +13259,17 @@ dependencies = [
  "syn 2.0.110",
 ]
 
+[[package]]
+name = "structmeta-derive"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "152a0b65a590ff6c3da95cabe2353ee04e6167c896b28e3b14478c2636c922fc"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.110",
+]
+
 [[package]]
 name = "strum"
 version = "0.25.0"
@@ -13540,7 +13708,7 @@ checksum = "b8361c808554228ad09bfed70f5c823caf8a3450b6881cc3a38eb57e8c08c1d9"
 dependencies = [
  "proc-macro2",
  "quote",
- "structmeta",
+ "structmeta 0.2.0",
  "syn 2.0.110",
 ]
 
@@ -13989,11 +14157,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1ed1f98e3fdc28d6d910e6737ae6ab1a93bf1985935a1193e68f93eeb68d24e"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit 0.22.20",
+]
+
 [[package]]
 name = "toml_datetime"
 version = "0.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dd7358ecb8fc2f8d014bf86f6f638ce72ba252a2c3a2572f2a795f1d23efb41"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "toml_edit"
@@ -14013,6 +14196,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "583c44c02ad26b0c3f3066fe629275e50627026c51ac2e595cca4c230ce1ce1d"
 dependencies = [
  "indexmap 2.14.0",
+ "serde",
+ "serde_spanned",
  "toml_datetime",
  "winnow 0.6.20",
 ]
@@ -14891,16 +15076,16 @@ dependencies = [
 
 [[package]]
 name = "walrus"
-version = "0.21.1"
+version = "0.22.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "467611cafbc8a84834b77d2b4bb191fd2f5769752def8340407e924390c6883b"
+checksum = "d68aa3c7b80be75c8458fc087453e5a31a226cfffede2e9b932393b2ea1c624a"
 dependencies = [
  "anyhow",
  "gimli 0.26.2",
  "id-arena",
  "leb128",
  "log",
- "walrus-macro 0.19.0",
+ "walrus-macro",
  "wasm-encoder 0.212.0",
  "wasmparser 0.212.0",
 ]
@@ -14916,23 +15101,11 @@ dependencies = [
  "id-arena",
  "leb128",
  "log",
- "walrus-macro 0.22.0",
+ "walrus-macro",
  "wasm-encoder 0.214.0",
  "wasmparser 0.214.0",
 ]
 
-[[package]]
-name = "walrus-macro"
-version = "0.19.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a6e5bd22c71e77d60140b0bd5be56155a37e5bd14e24f5f87298040d0cc40d7"
-dependencies = [
- "heck 0.3.3",
- "proc-macro2",
- "quote",
- "syn 1.0.109",
-]
-
 [[package]]
 name = "walrus-macro"
 version = "0.22.0"
@@ -15172,6 +15345,19 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "wasmparser"
+version = "0.223.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "664b980991ed9a8c834eb528a8979ab1109edcf52dc05dd5751e2cc3fb31035d"
+dependencies = [
+ "bitflags 2.10.0",
+ "hashbrown 0.15.2",
+ "indexmap 2.14.0",
+ "semver",
+ "serde",
+]
+
 [[package]]
 name = "wasmparser"
 version = "0.235.0"
diff --git a/bazel/canisters.bzl b/bazel/canisters.bzl
index 8482f469a802..282b5fc4744b 100644
--- a/bazel/canisters.bzl
+++ b/bazel/canisters.bzl
@@ -87,6 +87,9 @@ def rust_canister(name, service_file, visibility = ["//visibility:public"], test
     # The option to keep the name section is only required for wasm finalization.
     keep_name_section = kwargs.pop("keep_name_section", False)
 
+    # Optional path to a hidden_endpoints.conf for `ic-wasm check-endpoints`.
+    hidden_endpoints = kwargs.pop("hidden_endpoints", None)
+
     # Sanity checking (no '.' in name)
     if name.count(".") > 0:
         fail("name '{}' should not include dots".format(name))
@@ -126,6 +129,7 @@ def rust_canister(name, service_file, visibility = ["//visibility:public"], test
         visibility = visibility,
         testonly = testonly,
         keep_name_section = keep_name_section,
+        hidden_endpoints = hidden_endpoints,
     )
 
     native.alias(
@@ -181,27 +185,46 @@ def motoko_canister(name, entry, deps, **kwargs):
         actual = final_name,
     )
 
-def finalize_wasm(*, name, src_wasm, service_file = None, version_file, testonly, visibility = ["//visibility:public"], keep_name_section = False):
+def finalize_wasm(*, name, src_wasm, service_file = None, version_file, testonly, visibility = ["//visibility:public"], keep_name_section = False, hidden_endpoints = None):
     """Generates an output file name `name + '.wasm.gz'`.
 
     The input file is shrunk, annotated with metadata, and gzipped. The canister
     metadata consists of:
         'icp:public git_commit_id': version used in the build
         'icp:public candid:service': the canister's candid service description
+
+    When `hidden_endpoints` is provided (a label pointing at a `hidden_endpoints.conf`
+    file), `ic-wasm check-endpoints --hidden <conf>` is also run on the finalized
+    wasm before gzip, failing the build if the wasm exports a method that is
+    neither in the candid `service` nor allowlisted in the conf.
     """
+
+    steps = [
+        "{ic_wasm} {input_wasm} -o $@.shrunk shrink {keep_name_section}",
+        "{ic_wasm} $@.shrunk -o $@.meta metadata candid:service {keep_name_section} --visibility public --file " + "$(location {})".format(service_file) if not (service_file == None) else "cp $@.shrunk $@.meta",  # if service_file is None, don't include a service file
+        "{ic_wasm} $@.meta -o $@.ver metadata git_commit_id {keep_name_section} --visibility public --file {version_file}",
+    ]
+    if hidden_endpoints != None:
+        steps.append("{ic_wasm} $@.ver check-endpoints --hidden $(location {hidden_endpoints})")
+    steps.append("{pigz} --processes 16 --no-name $@.ver --stdout > $@")
+
     native.genrule(
         name = "_" + name + "_finalize",
-        srcs = [src_wasm, version_file] + ([service_file] if not (service_file == None) else []),
+        srcs = [src_wasm, version_file] +
+               ([service_file] if not (service_file == None) else []) +
+               ([hidden_endpoints] if hidden_endpoints != None else []),
         outs = [name],
         visibility = visibility,
         testonly = testonly,
         message = "Finalizing canister " + name,
         tools = ["@crate_index//:ic-wasm__ic-wasm", "@pigz"],
-        cmd_bash = " && ".join([
-            "{ic_wasm} {input_wasm} -o $@.shrunk shrink {keep_name_section}",
-            "{ic_wasm} $@.shrunk -o $@.meta metadata candid:service {keep_name_section} --visibility public --file " + "$(location {})".format(service_file) if not (service_file == None) else "cp $@.shrunk $@.meta",  # if service_file is None, don't include a service file
-            "{ic_wasm} $@.meta -o $@.ver metadata git_commit_id {keep_name_section} --visibility public --file {version_file}",
-            "{pigz} --processes 16 --no-name $@.ver --stdout > $@",
-        ])
-            .format(input_wasm = "$(location {})".format(src_wasm), ic_wasm = "$(location @crate_index//:ic-wasm__ic-wasm)", version_file = "$(location {})".format(version_file), pigz = "$(location @pigz)", keep_name_section = "--keep-name-section" if keep_name_section else ""),
+        cmd_bash = " && ".join(steps)
+            .format(
+            input_wasm = "$(location {})".format(src_wasm),
+            ic_wasm = "$(location @crate_index//:ic-wasm__ic-wasm)",
+            version_file = "$(location {})".format(version_file),
+            pigz = "$(location @pigz)",
+            keep_name_section = "--keep-name-section" if keep_name_section else "",
+            hidden_endpoints = hidden_endpoints if hidden_endpoints != None else "",
+        ),
     )
diff --git a/bazel/rust.MODULE.bazel b/bazel/rust.MODULE.bazel
index ff2fbf10e29a..6238bb06dd1b 100644
--- a/bazel/rust.MODULE.bazel
+++ b/bazel/rust.MODULE.bazel
@@ -771,10 +771,11 @@ crate.spec(
 crate.spec(
     default_features = False,
     features = [
+        "check-endpoints",
         "exe",
     ],
     package = "ic-wasm",
-    version = "^0.8.4",
+    version = "^0.9.10",
 )
 crate.spec(
     package = "ic-xrc-types",
diff --git a/rs/bitcoin/checker/BUILD.bazel b/rs/bitcoin/checker/BUILD.bazel
index 76034cb36a75..32a3412e9de6 100644
--- a/rs/bitcoin/checker/BUILD.bazel
+++ b/rs/bitcoin/checker/BUILD.bazel
@@ -45,6 +45,7 @@ rust_canister(
     compile_data = [
         "templates/dashboard.html",
     ],
+    hidden_endpoints = "hidden_endpoints.conf",
     service_file = "btc_checker_canister.did",
     deps = [
         # Keep sorted.
diff --git a/rs/bitcoin/checker/hidden_endpoints.conf b/rs/bitcoin/checker/hidden_endpoints.conf
new file mode 100644
index 000000000000..663ba4f629fa
--- /dev/null
+++ b/rs/bitcoin/checker/hidden_endpoints.conf
@@ -0,0 +1,9 @@
+# HTTP endpoint for fetching metrics
+canister_query:http_request
+# Transform function for HTTP outcalls
+canister_query:transform
+# Canister lifecycle
+canister_init
+canister_post_upgrade
+# Exported by the `main()` function in `main.rs`; cannot be called
+main
diff --git a/rs/bitcoin/ckbtc/minter/BUILD.bazel b/rs/bitcoin/ckbtc/minter/BUILD.bazel
index 3789641a8c40..1f9fdbff95d4 100644
--- a/rs/bitcoin/ckbtc/minter/BUILD.bazel
+++ b/rs/bitcoin/ckbtc/minter/BUILD.bazel
@@ -92,6 +92,7 @@ rust_doc_test(
         compile_data = [":ckbtc_minter.did"],
         crate_features = features,
         crate_name = "ic_ckbtc_minter_canister",
+        hidden_endpoints = hidden_endpoints,
         proc_macro_deps = [
             # Keep sorted.
         ],
@@ -112,16 +113,18 @@ rust_doc_test(
             "@crate_index//:serde_json",
         ],
     )
-    for (name, features) in [
+    for (name, features, hidden_endpoints) in [
         # Production version without debug assertions.
         (
             "ckbtc_minter",
             [],
+            "hidden_endpoints.conf",
         ),
         # Test version with internal consistency checks.
         (
             "ckbtc_minter_debug",
             ["self_check"],
+            "hidden_endpoints_debug.conf",
         ),
     ]
 ]
diff --git a/rs/bitcoin/ckbtc/minter/hidden_endpoints.conf b/rs/bitcoin/ckbtc/minter/hidden_endpoints.conf
new file mode 100644
index 000000000000..fcb0cd45d468
--- /dev/null
+++ b/rs/bitcoin/ckbtc/minter/hidden_endpoints.conf
@@ -0,0 +1,11 @@
+# IC system-level timer (wired via #[unsafe(export_name = "canister_global_timer")])
+canister_global_timer
+# HTTP endpoint for fetching metrics
+canister_query:http_request
+# Candid extraction tmp-hack endpoint (#[query(hidden = true)] in main.rs)
+canister_query:__get_candid_interface_tmp_hack
+# Canister lifecycle
+canister_init
+canister_post_upgrade
+# Exported by the `main()` function in `main.rs`; cannot be called
+main
diff --git a/rs/bitcoin/ckbtc/minter/hidden_endpoints_debug.conf b/rs/bitcoin/ckbtc/minter/hidden_endpoints_debug.conf
new file mode 100644
index 000000000000..edaba517f32c
--- /dev/null
+++ b/rs/bitcoin/ckbtc/minter/hidden_endpoints_debug.conf
@@ -0,0 +1,15 @@
+# Same as hidden_endpoints.conf plus the `self_check` query, which is
+# only compiled in when the `self_check` cargo feature is enabled (the
+# `ckbtc_minter_debug` variant). It is declared `#[query]` (i.e. not
+# hidden) but absent from the canonical `ckbtc_minter.did`, so it must
+# be allowlisted here.
+canister_global_timer
+canister_query:http_request
+canister_query:__get_candid_interface_tmp_hack
+canister_query:self_check
+# self_check-only update endpoints, also gated on the cargo feature
+canister_update:refresh_fee_percentiles
+canister_update:upload_events
+canister_init
+canister_post_upgrade
+main
diff --git a/rs/ethereum/cketh/minter/BUILD.bazel b/rs/ethereum/cketh/minter/BUILD.bazel
index ca1c34e00158..b79281ae0581 100644
--- a/rs/ethereum/cketh/minter/BUILD.bazel
+++ b/rs/ethereum/cketh/minter/BUILD.bazel
@@ -150,6 +150,7 @@ rust_test(
     ],
     crate_features = features,
     crate_name = "ic_cketh_minter_canister",
+    hidden_endpoints = hidden_endpoints,
     proc_macro_deps = [
         # Keep sorted.
     ],
@@ -175,11 +176,12 @@ rust_test(
         "@crate_index//:serde_bytes",
         "@crate_index//:time",
     ],
-) for (target_suffix, features) in [
-    ("", []),
+) for (target_suffix, features, hidden_endpoints) in [
+    ("", [], "hidden_endpoints.conf"),
     (
         "_debug",
         ["debug_checks"],
+        "hidden_endpoints_debug.conf",
     ),
 ]]
 
diff --git a/rs/ethereum/cketh/minter/hidden_endpoints.conf b/rs/ethereum/cketh/minter/hidden_endpoints.conf
new file mode 100644
index 000000000000..211a67c9257d
--- /dev/null
+++ b/rs/ethereum/cketh/minter/hidden_endpoints.conf
@@ -0,0 +1,13 @@
+# Timer endpoints exported by ic-cdk-timers (the dispatcher
+# `<ic-cdk internal> timer_executor` plus the IC system-level
+# `canister_global_timer` it registers itself against)
+canister_global_timer
+canister_update:<ic-cdk internal> timer_executor
+# HTTP endpoint for fetching metrics
+canister_query:http_request
+# Canister lifecycle
+canister_init
+canister_pre_upgrade
+canister_post_upgrade
+# Exported by the `main()` function in `main.rs`; cannot be called
+main
diff --git a/rs/ethereum/cketh/minter/hidden_endpoints_debug.conf b/rs/ethereum/cketh/minter/hidden_endpoints_debug.conf
new file mode 100644
index 000000000000..2138ba3ec6ab
--- /dev/null
+++ b/rs/ethereum/cketh/minter/hidden_endpoints_debug.conf
@@ -0,0 +1,13 @@
+# Same as hidden_endpoints.conf plus the `check_audit_log` query, which
+# is only compiled in when the `debug_checks` cargo feature is enabled
+# (the `cketh_minter_debug` variant). It is declared `#[query]` (not
+# hidden) but absent from cketh_minter.did, so it must be allowlisted
+# here.
+canister_global_timer
+canister_update:<ic-cdk internal> timer_executor
+canister_query:http_request
+canister_query:check_audit_log
+canister_init
+canister_pre_upgrade
+canister_post_upgrade
+main
diff --git a/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel b/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
index 9e9d7237f63f..f82b998a858f 100644
--- a/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
+++ b/rs/ethereum/ledger-suite-orchestrator/BUILD.bazel
@@ -113,6 +113,7 @@ rust_test(
             "templates/dashboard.html",
         ],
         crate_name = "ic_ledger_suite_orchestrator_canister" + name_suffix,
+        hidden_endpoints = "hidden_endpoints.conf",
         opt = "z",
         proc_macro_deps = [
             # Keep sorted.
diff --git a/rs/ethereum/ledger-suite-orchestrator/hidden_endpoints.conf b/rs/ethereum/ledger-suite-orchestrator/hidden_endpoints.conf
new file mode 100644
index 000000000000..ce9e9d69ffa5
--- /dev/null
+++ b/rs/ethereum/ledger-suite-orchestrator/hidden_endpoints.conf
@@ -0,0 +1,9 @@
+# IC system-level timer (wired via #[unsafe(export_name = "canister_global_timer")])
+canister_global_timer
+# HTTP endpoint for fetching metrics
+canister_query:http_request
+# Canister lifecycle
+canister_init
+canister_post_upgrade
+# Exported by the `main()` function in `main.rs`; cannot be called
+main
diff --git a/rs/ledger_suite/icp/ledger/BUILD.bazel b/rs/ledger_suite/icp/ledger/BUILD.bazel
index 66b92c0417b6..e9e1cd42195c 100644
--- a/rs/ledger_suite/icp/ledger/BUILD.bazel
+++ b/rs/ledger_suite/icp/ledger/BUILD.bazel
@@ -77,21 +77,27 @@ rust_test(
     deps = ["@crate_index//:proptest"],
 )
 
-rust_ledger_canister(name = "ledger-canister-wasm")
+rust_ledger_canister(
+    name = "ledger-canister-wasm",
+    hidden_endpoints = "hidden_endpoints.conf",
+)
 
 rust_ledger_canister(
     name = "ledger-canister-wasm-allowance-getter",
     crate_features = ["icp-allowance-getter"],
+    hidden_endpoints = "hidden_endpoints_allowance_getter.conf",
 )
 
 rust_ledger_canister(
     name = "ledger-canister-wasm-next-version",
     extra_deps = [":ledger_next_version"],
+    hidden_endpoints = "hidden_endpoints.conf",
 )
 
 rust_ledger_canister(
     name = "ledger-canister-wasm-prev-version",
     extra_deps = [":ledger_prev_version"],
+    hidden_endpoints = "hidden_endpoints.conf",
 )
 
 rust_test(
diff --git a/rs/ledger_suite/icp/ledger/hidden_endpoints.conf b/rs/ledger_suite/icp/ledger/hidden_endpoints.conf
new file mode 100644
index 000000000000..9fb25d13b551
--- /dev/null
+++ b/rs/ledger_suite/icp/ledger/hidden_endpoints.conf
@@ -0,0 +1,24 @@
+# Canister lifecycle (canister_init declared via #[unsafe(export_name = ...)])
+canister_init
+canister_pre_upgrade
+canister_post_upgrade
+# HTTP endpoint for fetching metrics (#[query(hidden = true)])
+canister_query:http_request
+# Candid extraction tmp-hack endpoint (#[query] but absent from ledger.did)
+canister_query:__get_candid_interface_tmp_hack
+# Legacy protobuf query endpoints (#[unsafe(export_name = "canister_query <name>")])
+canister_query:account_balance_pb
+canister_query:block_pb
+canister_query:get_archive_index_pb
+canister_query:get_blocks_pb
+canister_query:get_nodes
+canister_query:iter_blocks_pb
+canister_query:tip_of_chain_pb
+canister_query:total_supply_pb
+canister_query:transfer_fee_pb
+# Legacy protobuf update endpoints
+canister_update:notify_dfx
+canister_update:notify_pb
+canister_update:send_pb
+# Exported by the `main()` function in `main.rs`; cannot be called
+main
diff --git a/rs/ledger_suite/icp/ledger/hidden_endpoints_allowance_getter.conf b/rs/ledger_suite/icp/ledger/hidden_endpoints_allowance_getter.conf
new file mode 100644
index 000000000000..f8cc7ee2e308
--- /dev/null
+++ b/rs/ledger_suite/icp/ledger/hidden_endpoints_allowance_getter.conf
@@ -0,0 +1,24 @@
+# Same as hidden_endpoints.conf plus the `allowance` query, which is
+# only compiled in when the `icp-allowance-getter` cargo feature is
+# enabled (the `ledger-canister-wasm-allowance-getter` variant). It is
+# declared `#[query(name = "allowance")]` (not hidden) but absent from
+# ledger.did, so it must be allowlisted here.
+canister_init
+canister_pre_upgrade
+canister_post_upgrade
+canister_query:http_request
+canister_query:__get_candid_interface_tmp_hack
+canister_query:allowance
+canister_query:account_balance_pb
+canister_query:block_pb
+canister_query:get_archive_index_pb
+canister_query:get_blocks_pb
+canister_query:get_nodes
+canister_query:iter_blocks_pb
+canister_query:tip_of_chain_pb
+canister_query:total_supply_pb
+canister_query:transfer_fee_pb
+canister_update:notify_dfx
+canister_update:notify_pb
+canister_update:send_pb
+main
diff --git a/rs/ledger_suite/icp/ledger/ledger_canisters.bzl b/rs/ledger_suite/icp/ledger/ledger_canisters.bzl
index d44b2888dc5c..e89e7e7687dd 100644
--- a/rs/ledger_suite/icp/ledger/ledger_canisters.bzl
+++ b/rs/ledger_suite/icp/ledger/ledger_canisters.bzl
@@ -45,7 +45,7 @@ LEDGER_CANISTER_DEPS = [
     "@crate_index//:serde_bytes",
 ]
 
-def rust_ledger_canister(name, extra_deps = [":ledger"], crate_features = None):
+def rust_ledger_canister(name, extra_deps = [":ledger"], crate_features = None, hidden_endpoints = None):
     rust_canister(
         name = name,
         srcs = ["src/main.rs"],
@@ -55,6 +55,7 @@ def rust_ledger_canister(name, extra_deps = [":ledger"], crate_features = None):
         service_file = "//rs/ledger_suite/icp:ledger.did",
         deps = LEDGER_CANISTER_DEPS + extra_deps,
         crate_features = crate_features if crate_features else [],
+        hidden_endpoints = hidden_endpoints,
         proc_macro_deps = [
             # Keep sorted.
         ],
diff --git a/rs/ledger_suite/icrc1/ledger/BUILD.bazel b/rs/ledger_suite/icrc1/ledger/BUILD.bazel
index 3a642695d173..be9d52b92278 100644
--- a/rs/ledger_suite/icrc1/ledger/BUILD.bazel
+++ b/rs/ledger_suite/icrc1/ledger/BUILD.bazel
@@ -111,6 +111,14 @@ package(default_visibility = ["//visibility:public"])
         srcs = ["src/main.rs"] + glob(["src/benches/**/*.rs"]),
         crate_features = features,
         crate_name = "ic_icrc1_ledger_canister" + name_suffix,
+        # The `_getblocksdisabled` variants compile without `get_blocks`
+        # but share the same `ledger.did` (which still declares it). The
+        # `_canbench` variants compile in benchmark-only `__canbench__*`
+        # and `__tracing__*` query endpoints from canbench-rs that aren't
+        # in `ledger.did` either, and replace `canister_init` with the
+        # canbench harness's own. Opt both kinds of variants out of
+        # check-endpoints — they're test-only and not production canisters.
+        hidden_endpoints = None if ("get-blocks-disabled" in features or "canbench-rs" in features) else "hidden_endpoints.conf",
         opt = "z",
         proc_macro_deps = [
             # Keep sorted.
diff --git a/rs/ledger_suite/icrc1/ledger/hidden_endpoints.conf b/rs/ledger_suite/icrc1/ledger/hidden_endpoints.conf
new file mode 100644
index 000000000000..3fd49e613812
--- /dev/null
+++ b/rs/ledger_suite/icrc1/ledger/hidden_endpoints.conf
@@ -0,0 +1,10 @@
+# Canister lifecycle
+canister_init
+canister_pre_upgrade
+canister_post_upgrade
+# HTTP endpoint for fetching metrics (#[query(hidden = true)])
+canister_query:http_request
+# Candid extraction tmp-hack endpoint (#[query] but absent from ledger.did)
+canister_query:__get_candid_interface_tmp_hack
+# Exported by the `main()` function in `main.rs`; cannot be called
+main