diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 249bcaf28f..dd005f98b7 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -54,6 +54,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
   build-ubuntu:
     name: Build ubuntu24 (JDK 17 / aarch64)
     if: ${{ github.event_name == 'pull_request' || inputs.job == 'all' || inputs.job == 'ubuntu' }}
@@ -84,6 +93,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
   docker-build-rockylinux:
     name: Build rockylinux (JDK 8 / x86_64)
     if: ${{ github.event_name == 'pull_request' || inputs.job == 'all' || inputs.job == 'rockylinux' }}
@@ -127,6 +145,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
       - name: Test with RocksDB engine
         run: ./gradlew :framework:testWithRocksDb --no-daemon
 
@@ -172,6 +199,15 @@ jobs:
       - name: Build
         run: ./gradlew clean build --no-daemon --no-build-cache
 
+      - name: Toolkit jar smoke test
+        run: |
+          set -e
+          JAR=plugins/build/libs/Toolkit.jar
+          java -jar "$JAR" help
+          java -jar "$JAR" db --help
+          java -jar "$JAR" db archive -h
+          java -jar "$JAR" keystore --help
+
       - name: Test with RocksDB engine
         run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
 
diff --git a/plugins/build.gradle b/plugins/build.gradle
index 2e358a884a..03734fb09a 100644
--- a/plugins/build.gradle
+++ b/plugins/build.gradle
@@ -39,6 +39,16 @@ dependencies {
         exclude group: 'io.prometheus'
         exclude group: 'org.aspectj'
         exclude group: 'org.apache.httpcomponents'
+        // x86 declares io.github.tronprotocol:leveldbjni-all:1.18.2 below;
+        // :crypto -> :common -> :platform also transitively pulls
+        // org.fusesource.leveldbjni:leveldbjni-all:1.8. Both jars carry
+        // org/iq80/leveldb/Options.class and the fat jar's last-write-wins
+        // merge can leave the 1.8 copy, which lacks Options.maxBatchSize(int)
+        // and breaks `db archive` at runtime. Drop the 1.8 transitive on x86
+        // only; ARM64 has a single copy via :platform direct and no conflict.
+        if (!rootProject.archInfo.isArm64) {
+            exclude group: 'org.fusesource.leveldbjni', module: 'leveldbjni-all'
+        }
     }
     implementation group: 'info.picocli', name: 'picocli', version: '4.6.3'
     implementation group: 'com.typesafe', name: 'config', version: '1.3.2'
@@ -49,9 +59,12 @@ dependencies {
         implementation project(":platform")
     } else {
         implementation project(":platform"), {
+            // Only leveldbjni-all is excluded; the io.github.tronprotocol
+            // 1.18.2 fork below is the version we want on x86. zksnark-java-sdk
+            // and commons-io are intentionally kept (the plugins test runtime
+            // needs both via :crypto -> :common -> :platform and the duplicate
+            // resolution dedups to one copy).
             exclude(group: 'org.fusesource.leveldbjni', module: 'leveldbjni-all')
-            exclude(group: 'io.github.tronprotocol', module: 'zksnark-java-sdk')
-            exclude(group: 'commons-io', module: 'commons-io')
         }
         implementation 'io.github.tronprotocol:leveldbjni-all:1.18.2'
         implementation 'io.github.tronprotocol:leveldb:1.18.2'
@@ -130,7 +143,13 @@ def binaryRelease(taskName, jarName, mainClass) {
         from(sourceSets.main.output) {
             include "/**"
         }
-        dependsOn (project(':protocol').jar, project(':platform').jar) // explicit_dependency
+        // Fat jar zips up runtimeClasspath, which includes the jar outputs of
+        // every project dependency. Declare them all explicitly so Gradle does
+        // not warn about implicit_dependency and disable execution optimizations
+        // (and so partial / parallel builds cannot run binaryRelease before the
+        // dependency jars exist).
+        dependsOn (project(':protocol').jar, project(':platform').jar,
+                project(':crypto').jar, project(':common').jar) // explicit_dependency
         from {
             configurations.runtimeClasspath.collect { // https://docs.gradle.org/current/userguide/upgrading_version_6.html#changes_6.3
                 it.isDirectory() ? it : zipTree(it)