diff --git a/changelog.md b/changelog.md
index 0fc68c3..8859613 100644
--- a/changelog.md
+++ b/changelog.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 2026-03-15 - 25.11.2 - fix(rustproxy-http)
+avoid reusing HTTP/1 senders during streaming responses and relax HTTP/2 keep-alive timeouts
+
+- Stop returning HTTP/1 senders to the connection pool before upstream response bodies finish streaming to prevent unsafe reuse on active connections.
+- Increase HTTP/2 keep-alive timeout from 5 seconds to 30 seconds in proxy connection builders to better support longer-lived backend streams.
+- Improves reliability for large streaming payloads and backend fallback request handling.
+
 ## 2026-03-15 - 25.11.1 - fix(rustproxy-http)
 keep connection idle tracking alive during streaming and tune HTTP/2 connection lifetimes
 
diff --git a/rust/crates/rustproxy-http/src/proxy_service.rs b/rust/crates/rustproxy-http/src/proxy_service.rs
index 7b9c236..c5e1aa0 100644
--- a/rust/crates/rustproxy-http/src/proxy_service.rs
+++ b/rust/crates/rustproxy-http/src/proxy_service.rs
@@ -910,8 +910,15 @@ impl HttpProxyService {
             }
         };
 
-        // Return sender to pool (body streams lazily, sender is reusable once response head is received)
-        self.connection_pool.checkin_h1(pool_key.clone(), sender);
+        // Note: we do NOT return the sender to the pool here because the response body
+        // hasn't been fully streamed yet. Pooling a sender while its response body is still
+        // in-flight risks another request being dispatched on the same connection if is_ready()
+        // momentarily returns true between chunks. The sender is dropped after this scope,
+        // and the backend connection remains alive via the spawned conn driver task until
+        // the response body finishes streaming.
+        // For small/empty responses, the sender could theoretically be reused, but the safety
+        // of large streaming responses (e.g. 352MB Docker layers) takes priority.
+        drop(sender);
 
         self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
     }
@@ -939,7 +946,7 @@ impl HttpProxyService {
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
             .initial_stream_window_size(2 * 1024 * 1024)
             .initial_connection_window_size(16 * 1024 * 1024);
         let (sender, conn): (
@@ -1082,7 +1089,7 @@ impl HttpProxyService {
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
             .initial_stream_window_size(2 * 1024 * 1024)
             .initial_connection_window_size(16 * 1024 * 1024);
         let (mut sender, conn): (
@@ -1178,7 +1185,7 @@ impl HttpProxyService {
         h2_builder
             .timer(hyper_util::rt::TokioTimer::new())
             .keep_alive_interval(std::time::Duration::from_secs(10))
-            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .keep_alive_timeout(std::time::Duration::from_secs(30))
             .initial_stream_window_size(2 * 1024 * 1024)
             .initial_connection_window_size(16 * 1024 * 1024);
         let handshake_result = tokio::time::timeout(
@@ -1425,8 +1432,8 @@ impl HttpProxyService {
             }
         };
 
-        // Return sender to pool for keep-alive reuse
-        self.connection_pool.checkin_h1(pool_key.clone(), sender);
+        // Don't pool the sender while response body is still streaming (same safety as forward_h1_with_sender)
+        drop(sender);
 
         self.build_streaming_response(upstream_response, route, route_id, source_ip, conn_activity).await
     }
diff --git a/ts/00_commitinfo_data.ts b/ts/00_commitinfo_data.ts
index faffce7..b15a575 100644
--- a/ts/00_commitinfo_data.ts
+++ b/ts/00_commitinfo_data.ts
@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '25.11.1',
+  version: '25.11.2',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }