diff --git a/cli/commands/serve/proxy-extension-composition.test.ts b/cli/commands/serve/proxy-extension-composition.test.ts
index ac61da617b..54dd713019 100644
--- a/cli/commands/serve/proxy-extension-composition.test.ts
+++ b/cli/commands/serve/proxy-extension-composition.test.ts
@@ -99,6 +99,7 @@ describe("standalone proxy extension composition", () => {
       "shutdown registration failed",
     );
     assertEquals(tryResolve<TokenCacheStore>("TokenCacheStore"), undefined);
+    assertEquals(tryResolve(RedisRuntimeProviderName), undefined);
     loader = null;
   });
 
@@ -119,6 +120,7 @@ describe("standalone proxy extension composition", () => {
       "shutdown-hook disposal failed",
     );
     assertEquals(tryResolve<TokenCacheStore>("TokenCacheStore"), undefined);
+    assertEquals(tryResolve(RedisRuntimeProviderName), undefined);
     loader = null;
   });
 
@@ -159,6 +161,7 @@ describe("standalone proxy extension composition", () => {
     }
     await cleanup;
     assertEquals(tryResolve<TokenCacheStore>("TokenCacheStore"), undefined);
+    assertEquals(tryResolve(RedisRuntimeProviderName), undefined);
     loader = null;
   });
 });
diff --git a/cli/commands/serve/proxy-extension-composition.ts b/cli/commands/serve/proxy-extension-composition.ts
index 20d0283057..eff11adb8d 100644
--- a/cli/commands/serve/proxy-extension-composition.ts
+++ b/cli/commands/serve/proxy-extension-composition.ts
@@ -46,9 +46,24 @@ const CACHE_EXTENSION_PACKAGE_NAME = "@veryfront/ext-cache-redis";
 const REDIS_EXTENSION_SOURCE_DIRECTORY = "ext-redis";
 const REDIS_EXTENSION_PACKAGE_NAME = "@veryfront/ext-redis";
 
+async function loadFirstPartyExtension(
+  sourceDirectory: string,
+  packageName: string,
+): Promise<ExtensionFactory> {
+  const module = await importFirstPartyExtensionModule<ProxyExtensionModule>(
+    sourceDirectory,
+    packageName,
+  );
+  if (typeof module.default !== "function") {
+    throw new NativeTypeError(`${packageName} must export an ExtensionFactory`);
+  }
+  return module.default;
+}
+
 /**
- * Activate the standalone proxy's explicitly selected cache and Redis runtime
- * providers. The returned loader owns provider teardown.
+ * Activate the standalone proxy's explicitly selected infrastructure extensions.
+ * The returned loader owns provider teardown; the proxy borrows the registered
+ * Redis runtime and optional `TokenCacheStore` providers.
  */
 async function activateStandaloneProxyExtensionsInternal(): Promise<ExtensionLoader | null> {
   const cacheType = getEnv("CACHE_TYPE") || "memory";
@@ -58,41 +73,34 @@ async function activateStandaloneProxyExtensionsInternal(): Promise<ExtensionLoa
     );
   }
 
-  const selected: Array<{
+  const extensions: Array<{
+    extension: ReturnType<ExtensionFactory>;
     origin: string;
-    packageName: string;
-    sourceDirectory: string;
+    source: "config";
   }> = [];
-  if (cacheType === "extension" || cacheType === "redis") {
-    selected.push({
-      origin: "standalone proxy cache selection",
-      packageName: CACHE_EXTENSION_PACKAGE_NAME,
-      sourceDirectory: CACHE_EXTENSION_SOURCE_DIRECTORY,
-    });
-  }
   if (getEnv("REDIS_URL")) {
-    selected.push({
-      origin: "standalone proxy routing invalidation",
-      packageName: REDIS_EXTENSION_PACKAGE_NAME,
-      sourceDirectory: REDIS_EXTENSION_SOURCE_DIRECTORY,
+    const redisExtension = await loadFirstPartyExtension(
+      REDIS_EXTENSION_SOURCE_DIRECTORY,
+      REDIS_EXTENSION_PACKAGE_NAME,
+    );
+    extensions.push({
+      extension: redisExtension(),
+      source: "config",
+      origin: "standalone proxy Redis runtime",
     });
   }
-  if (selected.length === 0) return null;
-
-  const extensions = await NativePromise.all(selected.map(async (definition) => {
-    const module = await importFirstPartyExtensionModule<ProxyExtensionModule>(
-      definition.sourceDirectory,
-      definition.packageName,
+  if (cacheType === "extension" || cacheType === "redis") {
+    const cacheExtension = await loadFirstPartyExtension(
+      CACHE_EXTENSION_SOURCE_DIRECTORY,
+      CACHE_EXTENSION_PACKAGE_NAME,
     );
-    if (typeof module.default !== "function") {
-      throw new NativeTypeError(`${definition.packageName} must export an ExtensionFactory`);
-    }
-    return {
-      extension: module.default(),
-      source: "config" as const,
-      origin: definition.origin,
-    };
-  }));
+    extensions.push({
+      extension: cacheExtension(),
+      source: "config",
+      origin: "standalone proxy cache selection",
+    });
+  }
+  if (extensions.length === 0) return null;
 
   const loader = new ExtensionLoader(cliLogger);
   try {
@@ -110,7 +118,10 @@ async function activateStandaloneProxyExtensionsInternal(): Promise<ExtensionLoa
     try {
       await loader.teardownAll();
     } catch (cleanupError) {
-      cliLogger.error("Failed to clean up standalone proxy extensions", cleanupError);
+      cliLogger.error(
+        "Failed to clean up standalone proxy infrastructure extensions",
+        cleanupError,
+      );
     }
     throw error;
   }
@@ -146,7 +157,7 @@ async function registerStandaloneProxyExtensionTeardownInternal(
     } catch (cleanupError) {
       throw createProxyShutdownAggregateError(
         [error, cleanupError],
-        "Failed to register and clean up standalone proxy extension teardown",
+        "Failed to register and clean up standalone proxy infrastructure extension teardown",
       );
     }
     throw error;
@@ -169,7 +180,7 @@ async function registerStandaloneProxyExtensionTeardownInternal(
         if (disposalFailed) {
           throw createProxyShutdownAggregateError(
             [disposalError, teardownError],
-            "Failed to unregister and tear down standalone proxy extensions",
+            "Failed to unregister and tear down standalone proxy infrastructure extensions",
           );
         }
         throw teardownError;
diff --git a/deno.lock b/deno.lock
index 3db661d016..9122020026 100644
--- a/deno.lock
+++ b/deno.lock
@@ -61,7 +61,7 @@
     "npm:ajv@8.18.0": "8.18.0",
     "npm:bash-tool@1.3.18": "1.3.18_ai@7.0.41__zod@3.25.76_just-bash@3.0.1",
     "npm:better-sqlite3@9.6.0": "9.6.0",
-    "npm:brace-expansion@5.0.8": "5.0.8",
+    "npm:brace-expansion@5.0.9": "5.0.9",
     "npm:browserslist@4.28.7": "4.28.7",
     "npm:daisyui@5.5.14": "5.5.14",
     "npm:es-module-lexer@2.3.1": "2.3.1",
@@ -2961,8 +2961,8 @@
     "bowser@2.14.1": {
       "integrity": "sha512-tzPjzCxygAKWFOJP011oxFHs57HzIhOEracIgAePE4pqB3LikALKnSzUyU4MGs9/iCEUuHlAJTjTc5M+u7YEGg=="
     },
-    "brace-expansion@5.0.8": {
-      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
+    "brace-expansion@5.0.9": {
+      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
       "dependencies": [
         "balanced-match"
       ]
@@ -6545,7 +6545,7 @@
           "jsr:@std/testing@1.0.17",
           "npm:ai@7.0.41",
           "npm:bash-tool@1.3.18",
-          "npm:brace-expansion@5.0.8",
+          "npm:brace-expansion@5.0.9",
           "npm:just-bash@3.0.1"
         ]
       },
diff --git a/extensions/ext-sandbox-shell-tools/deno.json b/extensions/ext-sandbox-shell-tools/deno.json
index a3e0f55a05..39abf1754d 100644
--- a/extensions/ext-sandbox-shell-tools/deno.json
+++ b/extensions/ext-sandbox-shell-tools/deno.json
@@ -14,7 +14,7 @@
   "imports": {
     "ai": "npm:ai@7.0.41",
     "bash-tool": "npm:bash-tool@1.3.18",
-    "brace-expansion": "npm:brace-expansion@5.0.8",
+    "brace-expansion": "npm:brace-expansion@5.0.9",
     "just-bash": "npm:just-bash@3.0.1",
     "@std/assert": "jsr:@std/assert@1.0.19",
     "@std/testing/bdd": "jsr:@std/testing@1.0.17/bdd",
diff --git a/scripts/build/npm-package-metadata.test.ts b/scripts/build/npm-package-metadata.test.ts
index 614bda6aa8..2a2d9c20c1 100644
--- a/scripts/build/npm-package-metadata.test.ts
+++ b/scripts/build/npm-package-metadata.test.ts
@@ -404,7 +404,7 @@ describe("normalizeNpmPackageMetadata", () => {
         "@opentelemetry/sdk-metrics": "2.8.0",
         "@opentelemetry/sdk-node": "0.218.0",
         "@sentry/deno": "10.68.0",
-        "brace-expansion": "5.0.8",
+        "brace-expansion": "5.0.9",
         "gaxios": "7.2.0",
         "gcp-metadata": "8.1.2",
         "protobufjs": "7.6.5",
diff --git a/scripts/build/proxy-deno.lock b/scripts/build/proxy-deno.lock
index e9d40ce6b6..9adb8b0cfa 100644
--- a/scripts/build/proxy-deno.lock
+++ b/scripts/build/proxy-deno.lock
@@ -1690,7 +1690,7 @@
           "jsr:@std/testing@1.0.17",
           "npm:ai@7.0.41",
           "npm:bash-tool@1.3.18",
-          "npm:brace-expansion@5.0.8",
+          "npm:brace-expansion@5.0.9",
           "npm:just-bash@3.0.1"
         ]
       },