diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index edc83c64..bc6fcdad 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -51,6 +51,11 @@ updates:
       - dependency-name: "org.eclipse.jetty.*:*"
       - dependency-name: "org.springframework.boot:spring-boot-starter-parent"
       - dependency-name: "org.springframework.boot:spring-boot-starter-web"
+      # The runtime jars use the pure Java okio 1.x with grpc-okhttp; okio 2+ is written in Kotlin
+      # and needs kotlin-stdlib. okio.version is also checked by the runtime_impl poms.
+      - dependency-name: "com.squareup.okio:okio"
+        versions:
+          - ">= 2.0.0"
 
   - package-ecosystem: "github-actions"
     directory: "/"
diff --git a/pom.xml b/pom.xml
index 09168b5a..16196b3a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -69,6 +69,8 @@
     <auto-service.version>1.1.1</auto-service.version>
     <auto-value.version>1.11.1</auto-value.version>
     <grpc.version>1.85.0</grpc.version>
+    <!-- Must stay 1.x, enforced in the runtime_impl poms: okio 2+ is written in Kotlin. -->
+    <okio.version>1.17.6</okio.version>
     <jetty12.version>12.0.40</jetty12.version>
     <jetty121.version>12.1.14</jetty121.version>
     <slf4j.version>2.0.20</slf4j.version>
@@ -771,6 +773,13 @@
         <artifactId>javax.annotation-api</artifactId>
         <version>1.3.2</version>
       </dependency>
+      <dependency>
+        <!-- Pure Java okio for grpc-okhttp in the runtime jars, instead of okio 3.x which needs the
+             Kotlin stdlib. All okio APIs used by grpc-okhttp are present in 1.17.6. -->
+        <groupId>com.squareup.okio</groupId>
+        <artifactId>okio</artifactId>
+        <version>${okio.version}</version>
+      </dependency>
       <dependency>
         <groupId>com.google.auth</groupId>
         <artifactId>google-auth-library-oauth2-http</artifactId>
diff --git a/renovate.json b/renovate.json
index 89cdfbe4..a89f6221 100644
--- a/renovate.json
+++ b/renovate.json
@@ -28,6 +28,12 @@
       ],
       "enabled": false
     },
+    {
+      "matchPackageNames": [
+        "com.squareup.okio:okio"
+      ],
+      "allowedVersions": "<2.0.0"
+    },
     {
       "major": {
         "enabled": false
diff --git a/runtime/runtime_impl_jetty12/pom.xml b/runtime/runtime_impl_jetty12/pom.xml
index e4482f81..de6f99b5 100644
--- a/runtime/runtime_impl_jetty12/pom.xml
+++ b/runtime/runtime_impl_jetty12/pom.xml
@@ -58,6 +58,24 @@
             <artifactId>appengine-apis</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <!-- Lighter gRPC transport than grpc-netty-shaded for the bundled Cloud Tasks client. -->
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-okhttp</artifactId>
+            <optional>true</optional>
+            <exclusions>
+                <exclusion>
+                    <!-- okio 3.x is written in Kotlin and pulls in kotlin-stdlib. -->
+                    <groupId>com.squareup.okio</groupId>
+                    <artifactId>okio</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okio</groupId>
+            <artifactId>okio</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>com.google.appengine</groupId>
             <artifactId>runtime-util</artifactId>
@@ -317,6 +335,27 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>require-okio-1</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireProperty>
+                                    <property>okio.version</property>
+                                    <regex>1\.\d+(\.\d+)*</regex>
+                                    <regexMessage>okio.version must stay 1.x: the runtime jar bundles grpc-okhttp with the pure Java okio 1.x, while okio 2+ is written in Kotlin and needs kotlin-stdlib, which this jar does not bundle.</regexMessage>
+                                </requireProperty>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
@@ -335,12 +374,6 @@
                             </relocation>
                           </relocations>
                           <filters>
-                              <filter>
-                                  <artifact>io.grpc:grpc-netty-shaded</artifact>
-                                  <excludes>
-                                      <exclude>META-INF/native/**</exclude>
-                                  </excludes>
-                              </filter>
                              <filter>
                                   <artifact>*:*</artifact>
                                   <excludes>
@@ -515,7 +548,8 @@
                                     <include>io.grpc:grpc-auth</include>
                                     <include>io.grpc:grpc-context</include>
                                     <include>io.grpc:grpc-core</include>
-                                    <include>io.grpc:grpc-netty-shaded</include>
+                                    <include>io.grpc:grpc-okhttp</include>
+                                    <include>com.squareup.okio:okio</include>
                                     <include>io.grpc:grpc-protobuf</include>
                                     <include>io.grpc:grpc-protobuf-lite</include>
                                     <include>io.grpc:grpc-stub</include>
diff --git a/runtime/runtime_impl_jetty121/pom.xml b/runtime/runtime_impl_jetty121/pom.xml
index c1fa8034..5162fffd 100644
--- a/runtime/runtime_impl_jetty121/pom.xml
+++ b/runtime/runtime_impl_jetty121/pom.xml
@@ -58,6 +58,24 @@
             <artifactId>appengine-apis</artifactId>
             <optional>true</optional>
         </dependency>
+        <dependency>
+            <!-- Lighter gRPC transport than grpc-netty-shaded for the bundled Cloud Tasks client. -->
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-okhttp</artifactId>
+            <optional>true</optional>
+            <exclusions>
+                <exclusion>
+                    <!-- okio 3.x is written in Kotlin and pulls in kotlin-stdlib. -->
+                    <groupId>com.squareup.okio</groupId>
+                    <artifactId>okio</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okio</groupId>
+            <artifactId>okio</artifactId>
+            <optional>true</optional>
+        </dependency>
         <dependency>
             <groupId>com.google.appengine</groupId>
             <artifactId>runtime-util</artifactId>
@@ -340,6 +358,27 @@
 
     <build>
         <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-enforcer-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>require-okio-1</id>
+                        <goals>
+                            <goal>enforce</goal>
+                        </goals>
+                        <configuration>
+                            <rules>
+                                <requireProperty>
+                                    <property>okio.version</property>
+                                    <regex>1\.\d+(\.\d+)*</regex>
+                                    <regexMessage>okio.version must stay 1.x: the runtime jar bundles grpc-okhttp with the pure Java okio 1.x, while okio 2+ is written in Kotlin and needs kotlin-stdlib, which this jar does not bundle.</regexMessage>
+                                </requireProperty>
+                            </rules>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>
@@ -358,12 +397,6 @@
                             </relocation>
                           </relocations>
                           <filters>
-                              <filter>
-                                  <artifact>io.grpc:grpc-netty-shaded</artifact>
-                                  <excludes>
-                                      <exclude>META-INF/native/**</exclude>
-                                  </excludes>
-                              </filter>
                              <filter>
                                   <artifact>*:*</artifact>
                                   <excludes>
@@ -543,7 +576,8 @@
                                     <include>io.grpc:grpc-auth</include>
                                     <include>io.grpc:grpc-context</include>
                                     <include>io.grpc:grpc-core</include>
-                                    <include>io.grpc:grpc-netty-shaded</include>
+                                    <include>io.grpc:grpc-okhttp</include>
+                                    <include>com.squareup.okio:okio</include>
                                     <include>io.grpc:grpc-protobuf</include>
                                     <include>io.grpc:grpc-protobuf-lite</include>
                                     <include>io.grpc:grpc-stub</include>