diff --git a/CHANGELOG.md b/CHANGELOG.md
index 746cb735849..f19df37dfab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,7 +21,7 @@ Docs: https://docs.openclaw.ai
 - Discord/voice: lengthen the default voice join Ready wait, add configurable `voice.connectTimeoutMs`/`voice.reconnectGraceMs`, and warn before destroying unrecovered disconnected sessions so slow Discord voice handshakes and reconnects no longer fail silently. Fixes #63098; refs #39825 and #65039. Thanks @darealgege, @kzicherman, and @ayochim.
 - Gateway/health: refresh cached health RPC snapshots when channel runtime state diverges, so Discord and other channel status reads no longer report stale running or connected values until the cache TTL expires. (#75423) Thanks @clawsweeper.
 - Discord/voice: merge configured media-understanding providers such as Deepgram into partial active provider registries, so follow-up voice turns keep transcribing after another media plugin is already active. Fixes #65687. Thanks @OneMintJulep.
-- WhatsApp: stage `qrcode` with the WhatsApp plugin runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
+- WhatsApp: stage `qrcode` through root mirrored runtime dependencies so packaged QR pairing can render from staged plugin-runtime-deps installs. Fixes #75394. Thanks @FelipeX2001.
 - Discord/voice: apply per-channel Discord `systemPrompt` overrides to voice transcript turns by forwarding the trusted channel prompt through the voice agent run. Fixes #47095. Thanks @qearlyao.
 - Discord/voice: run voice-channel turns under a voice-output policy that hides the agent `tts` tool and asks for spoken reply text, so `/vc join` sessions synthesize and play agent replies instead of ending with `NO_REPLY`. Fixes #61536. Thanks @aounakram.
 - Plugins/runtime-deps: include packaged OpenClaw identity in bundled plugin loader cache keys, so same-path package upgrades stop reusing stale versioned runtime-deps mirrors. Fixes #75045. Thanks @sahilsatralkar.
diff --git a/extensions/whatsapp/package.json b/extensions/whatsapp/package.json
index ef398217bf2..3e44e2e9485 100644
--- a/extensions/whatsapp/package.json
+++ b/extensions/whatsapp/package.json
@@ -7,7 +7,6 @@
     "@whiskeysockets/baileys": "7.0.0-rc.9",
     "https-proxy-agent": "^9.0.0",
     "jimp": "^1.6.1",
-    "qrcode": "1.5.4",
     "typebox": "1.1.34",
     "undici": "8.1.0"
   },
diff --git a/package.json b/package.json
index 456b3f9b54f..2aa7c89e3e9 100644
--- a/package.json
+++ b/package.json
@@ -1766,6 +1766,7 @@
         "jszip",
         "markdown-it",
         "openai",
+        "qrcode",
         "semver",
         "sqlite-vec",
         "tar",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index c752cbe3ef4..9aca7c7c1e5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -1458,9 +1458,6 @@ importers:
       jimp:
         specifier: ^1.6.1
         version: 1.6.1
-      qrcode:
-        specifier: 1.5.4
-        version: 1.5.4
       typebox:
         specifier: 1.1.34
         version: 1.1.34
diff --git a/src/plugins/bundled-runtime-deps-drift.test.ts b/src/plugins/bundled-runtime-deps-drift.test.ts
index 1b60da8609e..ba990502b29 100644
--- a/src/plugins/bundled-runtime-deps-drift.test.ts
+++ b/src/plugins/bundled-runtime-deps-drift.test.ts
@@ -13,7 +13,6 @@ describe("mirrored root runtime dependency drift guard", () => {
     "file-type", // available transitively via mirrored deps
     "ipaddr.js", // available transitively via mirrored deps
     "proxy-agent", // available transitively via mirrored deps
-    "qrcode", // QR setup flows stage this through the owning channel plugin, not the root mirror
     "typescript", // CLI/dev only (api-baseline, jiti-runtime-api)
   ]);