diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index d291262..050b0b1 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -101,10 +101,13 @@ jobs:
           distribution: temurin
           java-version: '17'
       # GitHub-hosted runners ship gradle on PATH; the self-hosted act image does not, and the repo
-      # has no gradle wrapper. Provision gradle (latest stable, matching the local homebrew build).
-      - uses: gradle/actions/setup-gradle@v4
-        with:
-          gradle-version: current
+      # has no gradle wrapper. act also can't resolve the gradle/actions monorepo action, so install
+      # gradle directly (pinned to 9.5.1, matching the local homebrew build in CLAUDE.md/memory).
+      - name: Install Gradle 9.5.1
+        run: |
+          curl -sSL "https://services.gradle.org/distributions/gradle-9.5.1-bin.zip" -o /tmp/gradle.zip
+          sudo unzip -q -d /opt/gradle /tmp/gradle.zip
+          echo "/opt/gradle/gradle-9.5.1/bin" >> "$GITHUB_PATH"
       - name: Gradle test
         working-directory: clients/java
         run: gradle test
diff --git a/clients/rust/protos/mxaccess_worker.proto b/clients/rust/protos/mxaccess_worker.proto
index 06a22de..e50c4ff 100644
--- a/clients/rust/protos/mxaccess_worker.proto
+++ b/clients/rust/protos/mxaccess_worker.proto
@@ -42,6 +42,12 @@ message GatewayHello {
   uint32 supported_protocol_version = 1;
   string nonce = 2;
   string gateway_version = 3;
+  // Maximum worker-frame payload size, in bytes, negotiated by the gateway from its
+  // configured pipe limit. The worker adopts this as its frame-protocol MaxMessageBytes
+  // instead of a hard-coded default; 0 (an older gateway that never set the field) means
+  // "use the worker's built-in default". Sits above the public gRPC cap by an
+  // envelope-overhead margin so an accepted gRPC payload always fits one worker frame.
+  uint32 max_frame_bytes = 4;
 }
 
 message WorkerHello {
diff --git a/scripts/check-codegen.ps1 b/scripts/check-codegen.ps1
index 62fe57f..1035b24 100644
--- a/scripts/check-codegen.ps1
+++ b/scripts/check-codegen.ps1
@@ -52,7 +52,9 @@ try {
         $failures.Add('Contracts project failed to build during codegen check.')
     }
 
-    $diff = (& git -C $repoRoot status --porcelain -- 'src/ZB.MOM.WW.MxGateway.Contracts/Generated').Trim()
+    # Pipe through Out-String so a clean tree (git emits nothing -> $null) does not throw
+    # "cannot call a method on a null-valued expression"; Out-String yields '' for no output.
+    $diff = (& git -C $repoRoot status --porcelain -- 'src/ZB.MOM.WW.MxGateway.Contracts/Generated' | Out-String).Trim()
     if (-not [string]::IsNullOrEmpty($diff)) {
         Write-Host $diff
         $failures.Add('Contracts/Generated differs from a fresh regeneration. Run `dotnet build` on the contracts project and commit Generated/ (required for the net48 worker build).')