diff --git a/Cargo.lock b/Cargo.lock
index 9cf5a51e6..069fc3a6c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3847,17 +3847,6 @@ dependencies = [
  "unsafe-libyaml",
 ]
 
-[[package]]
-name = "sha-1"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
-dependencies = [
- "cfg-if",
- "cpufeatures",
- "digest",
-]
-
 [[package]]
 name = "sha1"
 version = "0.10.5"
@@ -4455,9 +4444,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-tungstenite"
-version = "0.17.2"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f714dd15bead90401d77e04243611caec13726c2408afd5b31901dfcdcb3b181"
+checksum = "212d5dcb2a1ce06d81107c3d0ffa3121fe974b73f068c8282cb1c32328113b6c"
 dependencies = [
  "futures-util",
  "log",
@@ -4673,18 +4662,18 @@ checksum = "3528ecfd12c466c6f163363caf2d02a71161dd5e1cc6ae7b34207ea2d42d81ed"
 
 [[package]]
 name = "tungstenite"
-version = "0.17.3"
+version = "0.20.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e27992fd6a8c29ee7eef28fc78349aa244134e10ad447ce3b9f0ac0ed0fa4ce0"
+checksum = "9e3dac10fd62eaf6617d3a904ae222845979aec67c615d1c842b4002c7666fb9"
 dependencies = [
- "base64 0.13.1",
  "byteorder",
  "bytes",
+ "data-encoding",
  "http",
  "httparse",
  "log",
  "rand",
- "sha-1",
+ "sha1",
  "thiserror",
  "url",
  "utf-8",
diff --git a/Cargo.toml b/Cargo.toml
index 0cc33e382..4c02fa20a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -137,7 +137,7 @@ syn = "1.0"
 tempfile = "3.2"
 thiserror = "1.0"
 tokio = "1"
-tokio-tungstenite = "0.17"
+tokio-tungstenite = "0.20"
 tokio-util = "0.7"
 toml = "0.7.6"
 tracing = "0.1.35"
diff --git a/bin/propolis-server/src/lib/mock_server.rs b/bin/propolis-server/src/lib/mock_server.rs
index 040675011..fe1c52bb8 100644
--- a/bin/propolis-server/src/lib/mock_server.rs
+++ b/bin/propolis-server/src/lib/mock_server.rs
@@ -329,8 +329,12 @@ async fn instance_serial(
     query: Query<api::InstanceSerialConsoleStreamRequest>,
     websock: WebsocketConnection,
 ) -> dropshot::WebsocketChannelResult {
-    let config =
-        WebSocketConfig { max_send_queue: Some(4096), ..Default::default() };
+    let config = WebSocketConfig {
+        // tune the buffer size limits down (compared to the defaults)
+        write_buffer_size: 4096,
+        max_write_buffer_size: 8192,
+        ..Default::default()
+    };
     let mut ws_stream = WebSocketStream::from_raw_socket(
         websock.into_inner(),
         Role::Server,
diff --git a/bin/propolis-server/src/lib/server.rs b/bin/propolis-server/src/lib/server.rs
index 88ac2e1c5..eb1656866 100644
--- a/bin/propolis-server/src/lib/server.rs
+++ b/bin/propolis-server/src/lib/server.rs
@@ -831,8 +831,13 @@ async fn instance_serial(
     let vm = ctx.vm().await?;
     let serial = vm.com1().clone();
 
-    let config =
-        WebSocketConfig { max_send_queue: Some(4096), ..Default::default() };
+    let config = WebSocketConfig {
+        // tune the buffer size limits down (compared to the defaults)
+        // TODO: tuning for this could be explored
+        write_buffer_size: 4096,
+        max_write_buffer_size: 8192,
+        ..Default::default()
+    };
     let mut ws_stream = WebSocketStream::from_raw_socket(
         websock.into_inner(),
         Role::Server,
diff --git a/lib/propolis-client/src/lib.rs b/lib/propolis-client/src/lib.rs
index 3eabdceee..08d482c90 100644
--- a/lib/propolis-client/src/lib.rs
+++ b/lib/propolis-client/src/lib.rs
@@ -140,7 +140,9 @@ pub mod support {
                 .send()
                 .await
                 .map_err(|e| {
-                    WSError::Http(http::Response::new(Some(e.to_string())))
+                    WSError::Http(http::Response::new(Some(
+                        e.to_string().into_bytes(),
+                    )))
                 })?
                 .into_inner();
 
@@ -190,9 +192,10 @@ pub mod support {
                 tokio::time::sleep(delay).await;
                 Ok(Box::new(stream))
             } else {
-                Err(WSError::Http(http::Response::new(Some(format!(
-                    "no duplex connection found for address {address}"
-                )))))
+                Err(WSError::Http(http::Response::new(Some(
+                    format!("no duplex connection found for address {address}")
+                        .into_bytes(),
+                ))))
             }
         }
     }