diff --git a/CHECKLIST.md b/CHECKLIST.md
index b1e7533..273d8a2 100644
--- a/CHECKLIST.md
+++ b/CHECKLIST.md
@@ -5,7 +5,7 @@
 ## Работает сейчас
 
 - [x] Go server, SQLite/WAL, Docker/Compose и `/healthz`.
-- [x] Go agent 0.6.2, heartbeat, команды, backoff и OpenWrt init integration.
+- [x] Go agent 0.6.3, heartbeat, команды, backoff и OpenWrt init integration.
 - [x] APK/IPK и LuCI-пакет.
 - [x] Multi-user, роли admin/user, владение и передача роутеров.
 - [x] Профиль, e-mail, смена/сброс пароля и управление сессиями.
diff --git a/RELEASES.md b/RELEASES.md
index 59716c8..7b63699 100644
--- a/RELEASES.md
+++ b/RELEASES.md
@@ -29,7 +29,7 @@ production upgrade even when the release is marked compatible.
 
 ## Agent releases
 
-Tags use `agent-vMAJOR.MINOR.PATCH`, for example `agent-v0.6.2`.
+Tags use `agent-vMAJOR.MINOR.PATCH`, for example `agent-v0.6.3`.
 
 An agent release contains the Go runtime, LuCI application and OpenWrt IPK/APK packages.
 Before tagging, the tag version must match `agentVersion` in the Go source and
@@ -58,8 +58,8 @@ transition period; it should not silently reuse `v1`.
 git tag -a server-v0.8.0 -m "OpenWrt RMM Server 0.8.0"
 git push origin server-v0.8.0
 
-git tag -a agent-v0.6.2 -m "OpenWrt RMM Agent 0.6.2"
-git push origin agent-v0.6.2
+git tag -a agent-v0.6.3 -m "OpenWrt RMM Agent 0.6.3"
+git push origin agent-v0.6.3
 ```
 
 Pushing a server tag publishes the container image and creates a GitHub Release. Pushing
diff --git a/ROADMAP.md b/ROADMAP.md
index 2084e8a..c86c9dc 100644
--- a/ROADMAP.md
+++ b/ROADMAP.md
@@ -1,6 +1,6 @@
 # OpenWrt RMM — актуальный roadmap
 
-Актуализировано: 2026-07-23. Текущая стабильная линия агента: `0.6.2`.
+Актуализировано: 2026-07-23. Текущая стабильная линия агента: `0.6.3`.
 
 ## Цель продукта
 
diff --git a/agent/README.md b/agent/README.md
index 8f63c9d..131f097 100644
--- a/agent/README.md
+++ b/agent/README.md
@@ -1,6 +1,6 @@
 # OpenWrt RMM Agent
 
-Current stable Go agent: `0.6.2`. It reports runtime health, pending command results,
+Current stable Go agent: `0.6.3`. It reports runtime health, pending command results,
 and the last heartbeat transport error after connectivity is restored.
 
 Production Go agent for OpenWrt, with the shell implementation retained as a fallback runtime.
diff --git a/agent/go/cmd/rmm-agent/main.go b/agent/go/cmd/rmm-agent/main.go
index 164040c..a12c070 100644
--- a/agent/go/cmd/rmm-agent/main.go
+++ b/agent/go/cmd/rmm-agent/main.go
@@ -23,7 +23,7 @@ import (
 	"time"
 )
 
-const agentVersion = "0.6.2"
+const agentVersion = "0.6.3"
 
 type agentRuntimeHealth struct {
 	StartedAt            time.Time
diff --git a/agent/go/cmd/rmm-agent/main_test.go b/agent/go/cmd/rmm-agent/main_test.go
index 09b0ef0..2ddaa1c 100644
--- a/agent/go/cmd/rmm-agent/main_test.go
+++ b/agent/go/cmd/rmm-agent/main_test.go
@@ -9,7 +9,7 @@ import (
 )
 
 func TestAgentVersionIsStable(t *testing.T) {
-	if agentVersion != "0.6.2" {
+	if agentVersion != "0.6.3" {
 		t.Fatalf("unexpected agent version %q", agentVersion)
 	}
 }
diff --git a/agent/package/luci-app-rmm-agent/README.md b/agent/package/luci-app-rmm-agent/README.md
index 30c0d99..fe7351e 100644
--- a/agent/package/luci-app-rmm-agent/README.md
+++ b/agent/package/luci-app-rmm-agent/README.md
@@ -67,7 +67,7 @@ application to the router. Do not copy or install the shell runtime at the same
 cd dist/rmm-openwrt-25.12.4-ramips-mt7621
 sha256sum -c SHA256SUMS
 scp \
-  rmm-agent-go-production-0.6.2-r1.apk \
+  rmm-agent-go-production-0.6.3-r1.apk \
   luci-app-rmm-agent-0.2.1-r2.apk \
   root@ROUTER_IP:/tmp/
 ```
@@ -76,7 +76,7 @@ Then install the locally built, unsigned packages over SSH:
 
 ```sh
 apk add --allow-untrusted \
-  /tmp/rmm-agent-go-production-0.6.2-r1.apk \
+  /tmp/rmm-agent-go-production-0.6.3-r1.apk \
   /tmp/luci-app-rmm-agent-0.2.1-r2.apk
 /etc/init.d/rpcd restart
 /etc/init.d/uhttpd restart
diff --git a/agent/package/rmm-agent-go-production/Makefile b/agent/package/rmm-agent-go-production/Makefile
index c6f5da4..8bfc784 100644
--- a/agent/package/rmm-agent-go-production/Makefile
+++ b/agent/package/rmm-agent-go-production/Makefile
@@ -2,7 +2,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rmm-agent-go-production
-PKG_VERSION:=0.6.2
+PKG_VERSION:=0.6.3
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=RMM OpenWrt
diff --git a/agent/package/rmm-agent-go-production/README.md b/agent/package/rmm-agent-go-production/README.md
index 1348543..da81a85 100644
--- a/agent/package/rmm-agent-go-production/README.md
+++ b/agent/package/rmm-agent-go-production/README.md
@@ -34,5 +34,5 @@ opkg install /tmp/rmm-agent-go-production_*.ipk
 
 This package is intended for the final shell-to-Go migration when the router should keep the same RMM object identity.
 
-Version `0.6.2` uses the cloud tunnel exclusively and no longer discovers or publishes the
+Version `0.6.3` uses the cloud tunnel exclusively and no longer discovers or publishes the
 router's public WAN addresses.
diff --git a/agent/package/rmm-agent-go/Makefile b/agent/package/rmm-agent-go/Makefile
index ca39cb4..e7de82f 100644
--- a/agent/package/rmm-agent-go/Makefile
+++ b/agent/package/rmm-agent-go/Makefile
@@ -2,7 +2,7 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=rmm-agent-go
-PKG_VERSION:=0.6.2
+PKG_VERSION:=0.6.3
 PKG_RELEASE:=1
 
 PKG_MAINTAINER:=RMM OpenWrt
diff --git a/deploy/luci-builder/Dockerfile b/deploy/luci-builder/Dockerfile
index 01911d5..da55fd4 100644
--- a/deploy/luci-builder/Dockerfile
+++ b/deploy/luci-builder/Dockerfile
@@ -97,7 +97,6 @@ RUN ./scripts/feeds update -a \
         ./scripts/feeds install "${package_name}"; \
        done
 
-COPY --chown=builder:builder agent/package/rmm-agent package/rmm-agent
 COPY --chown=builder:builder agent/package/rmm-agent-go-production package/rmm-agent-go-production
 COPY --from=go-agent --chown=builder:builder /out/rmm-agent package/rmm-agent-go-production/files/usr/bin/rmm-agent
 
@@ -107,12 +106,15 @@ RUN printf '%s\n' \
         '# CONFIG_ALL_NONSHARED is not set' \
         'CONFIG_PACKAGE_libmbedtls=y' \
         'CONFIG_PACKAGE_libustream-mbedtls=y' \
-        'CONFIG_PACKAGE_rmm-agent=m' \
         'CONFIG_PACKAGE_rmm-agent-go-production=m' \
         > .config \
     && make defconfig \
     && awk ' \
-        /^CONFIG_PACKAGE_[^=]+=[ym]$/ { \
+        /^CONFIG_PACKAGE_(ca-bundle|ip-tiny|iwinfo|libopenssl|openssh-client|openssh-keygen|rmm-agent-go-production|zlib)=m$/ { \
+            print; \
+            next; \
+        } \
+        /^CONFIG_PACKAGE_[^=]+=m$/ { \
             split($0, parts, "="); \
             print "# " parts[1] " is not set"; \
             next; \
@@ -120,20 +122,16 @@ RUN printf '%s\n' \
         { print; } \
        ' .config > .config.packages-pruned \
     && mv .config.packages-pruned .config \
-    && printf '%s\n' \
-        'CONFIG_PACKAGE_libmbedtls=y' \
-        'CONFIG_PACKAGE_libustream-mbedtls=y' \
-        'CONFIG_PACKAGE_rmm-agent=m' \
-        'CONFIG_PACKAGE_rmm-agent-go-production=m' \
-        >> .config \
-    && make defconfig
+    && grep -q '^CONFIG_PACKAGE_rmm-agent-go-production=m$' .config
 
 RUN make -j"$(nproc)" package/feeds/base/mbedtls/compile \
     && make -j"$(nproc)" package/feeds/base/ustream-ssl/compile
 
-RUN make -j"$(nproc)" \
-        package/rmm-agent/compile \
-        package/rmm-agent-go-production/compile
+RUN if ! make -j"$(nproc)" package/rmm-agent-go-production/compile V=s \
+        > /tmp/rmm-openwrt-build.log 2>&1; then \
+      tail -n 400 /tmp/rmm-openwrt-build.log; \
+      exit 1; \
+    fi
 
 COPY --chown=builder:builder agent/package/luci-app-rmm-agent package/luci-app-rmm-agent
 
@@ -144,7 +142,21 @@ RUN rm -rf tmp/info \
         tmp/.packageinfo
 
 RUN printf '%s\n' 'CONFIG_PACKAGE_luci-app-rmm-agent=m' >> .config \
-    && make defconfig
+    && make defconfig \
+    && awk ' \
+        /^CONFIG_PACKAGE_(ca-bundle|ip-tiny|iwinfo|libopenssl|luci-app-rmm-agent|openssh-client|openssh-keygen|rmm-agent-go-production|zlib)=m$/ { \
+            print; \
+            next; \
+        } \
+        /^CONFIG_PACKAGE_[^=]+=m$/ { \
+            split($0, parts, "="); \
+            print "# " parts[1] " is not set"; \
+            next; \
+        } \
+        { print; } \
+       ' .config > .config.packages-pruned \
+    && mv .config.packages-pruned .config \
+    && grep -q '^CONFIG_PACKAGE_luci-app-rmm-agent=m$' .config
 
 RUN make -j1 package/luci-app-rmm-agent/compile V=s
 
@@ -152,6 +164,8 @@ COPY --chown=builder:builder keys/openwrt /home/builder/release-keys
 
 RUN --mount=type=secret,id=openwrt_usign_secret_b64,uid=1000,required=false \
     --mount=type=secret,id=openwrt_apk_secret_b64,uid=1000,required=false \
+    set -eu; \
+    export PATH="/home/builder/sdk/staging_dir/host/bin:${PATH}"; \
     test -n "${REPOSITORY_INDEX_REVISION}" \
     && mkdir -p /home/builder/artifacts \
     && find bin -type f \
@@ -165,12 +179,15 @@ RUN --mount=type=secret,id=openwrt_usign_secret_b64,uid=1000,required=false \
     && if find . -maxdepth 1 -type f -name '*.ipk' -print -quit | grep -q .; then \
         /home/builder/sdk/scripts/ipkg-make-index.sh . > Packages; \
         gzip -9nc Packages > Packages.gz; \
+        test -s Packages; \
+        test -s Packages.gz; \
         if [ -s /run/secrets/openwrt_usign_secret_b64 ]; then \
           base64 -d /run/secrets/openwrt_usign_secret_b64 > /tmp/usign.sec; \
           chmod 600 /tmp/usign.sec; \
           /home/builder/sdk/staging_dir/host/bin/usign -S -m Packages -s /tmp/usign.sec; \
           /home/builder/sdk/staging_dir/host/bin/usign -V -m Packages \
             -p /home/builder/release-keys/usign/7fb0908fb6bc82c8; \
+          test -s Packages.sig; \
           cp /home/builder/release-keys/usign/7fb0908fb6bc82c8 ./; \
           rm -f /tmp/usign.sec; \
         elif [ "${REQUIRE_NATIVE_SIGNATURE}" = "true" ]; then \
diff --git a/docs/openwrt.md b/docs/openwrt.md
index 1417eed..8631426 100644
--- a/docs/openwrt.md
+++ b/docs/openwrt.md
@@ -146,8 +146,10 @@ The release matrix covers OpenWrt `21.02.7`, `22.03.7`, `23.05.5`, `24.10.7` and
 The workflow reads each official SDK URL and SHA256 from the reviewed
 `.github/openwrt-sdk-lock.tsv` lock file. Updating an OpenWrt patch release requires
 refreshing that file from the official `sha256sums`; Docker still verifies every SDK
-archive before extraction and retries transient downloads. Releases through `24.10`
-produce `.ipk`; `25.12` produces `.apk`. Manual runs retain each target as a workflow
+archive before extraction and retries transient downloads. The release builder packages
+only the production Go runtime and LuCI application; the legacy shell implementation
+remains in the source tree but is not published. Releases through `24.10` produce `.ipk`;
+`25.12` produces `.apk`. Manual runs retain each target as a workflow
 artifact for 30 days. An `agent-v*` tag also creates a GitHub Release containing all packages and
 a combined `SHA256SUMS`, a Sigstore signature bundle and native signed package feeds.
 See [package-repository.md](package-repository.md) for key provisioning and the commands
diff --git a/web/app.js b/web/app.js
index f9e226a..f47d67b 100644
--- a/web/app.js
+++ b/web/app.js
@@ -38,7 +38,7 @@ const state = {
 let eventSource = null;
 let liveRefreshTimer = null;
 
-const EXPECTED_AGENT_VERSION = "0.6.2";
+const EXPECTED_AGENT_VERSION = "0.6.3";
 
 const els = {
   loginView: document.querySelector("#loginView"),