diff --git a/requirements-test.txt b/requirements-test.txt
index a11b33a4..efbbf522 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -7,3 +7,4 @@
 # pytest>=9.0.3,<10 and made the two files impossible to install together.
 # Only declare what requirements.txt doesn't already provide.
 freezegun>=1.2,<2        # deterministic time for golden-image tests
+mypy>=1.5.0,<2.0.0       # static type checking (also pinned in .pre-commit-config.yaml)
diff --git a/requirements.txt b/requirements.txt
index 4b78e234..b673f04e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -11,27 +11,22 @@ pytz>=2024.2,<2025.0  # Updated for latest timezone data
 
 # HTTP requests
 requests>=2.33.0,<3.0.0
+urllib3>=1.26.0,<3.0.0  # requests transitive, but imported directly (urllib3.util.retry.Retry)
 
 # Google API integration
 
 # Font rendering
 freetype-py>=2.5.1,<3.0.0
 
-# Spotify integration
+# Spotify integration (used by web_interface/blueprints/api_v3.py OAuth endpoints)
 spotipy>=2.25.2,<3.0.0
 
 # Flask web framework
 Flask>=3.1.3,<4.0.0
 
-# Text processing
-
-# Calendar integration
-
-# WebSocket support
-python-socketio>=5.14.0,<6.0.0
-python-engineio>=4.9.0,<5.0.0
-websockets>=12.0,<14.0
-websocket-client>=1.8.0,<2.0.0
+# WebSocket support: intentionally NOT declared here. Plugins that need
+# it (e.g. ledmatrix-music's Socket.IO client) declare it in their own
+# requirements.txt, which the plugin store installs.
 
 # JSON Schema validation
 jsonschema>=4.20.0,<5.0.0
@@ -43,7 +38,6 @@ packaging>=23.0,<27.0
 pytest>=9.0.3,<10.0.0
 pytest-cov>=4.1.0,<5.0.0
 pytest-mock>=3.11.0,<4.0.0
-mypy>=1.5.0,<2.0.0
 
 # ───────────────────────────────────────────────────────────────────────
 # Optional dependencies — the code imports these inside try/except
diff --git a/scripts/install_dependencies_apt.py b/scripts/install_dependencies_apt.py
index a03d0243..c877ab67 100644
--- a/scripts/install_dependencies_apt.py
+++ b/scripts/install_dependencies_apt.py
@@ -49,12 +49,7 @@ def install_via_apt(package_name: str) -> Tuple[bool, str]:
         'werkzeug': 'python3-werkzeug',
         'numpy': 'python3-numpy',
         'requests': 'python3-requests',
-        'python-dateutil': 'python3-dateutil',
-        'pytz': 'python3-tz',
-        'geopy': 'python3-geopy',
-        'unidecode': 'python3-unidecode',
-        'websockets': 'python3-websockets',
-        'websocket-client': 'python3-websocket-client'
+        'pytz': 'python3-tz'
     }
 
     apt_package = apt_package_map.get(package_name, f'python3-{package_name}')
@@ -152,12 +147,7 @@ def main():
         'werkzeug',
         'numpy',
         'requests',
-        'python-dateutil',
-        'pytz',
-        'geopy',
-        'unidecode',
-        'websockets',
-        'websocket-client'
+        'pytz'
     ]
 
     failed_packages = []
@@ -177,15 +167,12 @@ def main():
                 failure_details[package] = pip_output or apt_output
 
     # Install packages that don't have apt equivalents
+    # Packages without apt equivalents. Plugin-specific dependencies
+    # (timezonefinder, google-api stack, icalevents, socketio, ...) are
+    # no longer installed here — store plugins declare their own
+    # requirements.txt, which the plugin store installs.
     special_packages = [
-        'timezonefinder>=6.5.0,<7.0.0',
-        'google-auth-oauthlib>=1.2.0,<2.0.0',
-        'google-auth-httplib2>=0.2.0,<1.0.0',
-        'google-api-python-client>=2.147.0,<3.0.0',
         'spotipy',
-        'icalevents',
-        'python-socketio>=5.11.0,<6.0.0',
-        'python-engineio>=4.9.0,<5.0.0'
     ]
 
     for package in special_packages:
diff --git a/web_interface/requirements.txt b/web_interface/requirements.txt
index 3363b779..f04386e7 100644
--- a/web_interface/requirements.txt
+++ b/web_interface/requirements.txt
@@ -4,20 +4,15 @@
 
 # Web framework
 flask>=3.1.3,<4.0.0
-werkzeug>=3.1.6,<4.0.0
-flask-wtf>=1.2.0  # CSRF protection (optional for local-only, but recommended)
 flask-limiter>=3.5.0,<4.0.0  # Rate limiting (prevent accidental abuse)
 flask-compress>=1.14  # gzip/brotli response compression (big win for the large JS/HTML over WiFi)
+jinja2>=3.1.0,<4.0.0  # Flask transitive, but imported directly (TemplateNotFound)
+markupsafe>=2.1.0,<4.0.0  # Flask transitive, but imported directly (escape)
 
-# WebSocket support for plugins
-# Note: Web interface uses Server-Sent Events (SSE) for real-time updates, not WebSockets
-# However, plugins may need websocket support to connect to external services
-# (e.g., music plugin connecting to YTM Companion server via Socket.IO)
-# These packages are required for plugin compatibility
-python-socketio>=5.14.0,<6.0.0
-python-engineio>=4.9.0,<5.0.0
-websockets>=12.0,<14.0
-websocket-client>=1.8.0,<2.0.0
+# WebSocket support: intentionally NOT declared here. The web interface
+# uses Server-Sent Events, and plugins that need Socket.IO (e.g.
+# ledmatrix-music) declare it in their own requirements.txt, which the
+# plugin store installs.
 
 # Image processing
 Pillow>=12.2.0,<13.0.0
@@ -35,24 +30,13 @@ numpy>=1.24.0
 # HTTP requests
 requests>=2.33.0,<3.0.0
 
-# Date/time utilities
-python-dateutil>=2.9.0,<3.0.0
-
 # Timezone handling (must match main requirements)
 pytz>=2024.2,<2025.0
-timezonefinder>=6.5.0,<7.0.0
-geopy>=2.4.1,<3.0.0
-
-# Google API integration (must match main requirements)
-google-auth-oauthlib>=1.2.0,<2.0.0
-google-auth-httplib2>=0.2.0,<1.0.0
-google-api-python-client>=2.147.0,<3.0.0
 
 # Spotify integration (must match main requirements)
 spotipy>=2.25.2,<3.0.0
 
-# Text processing (must match main requirements)
-unidecode>=1.3.8,<2.0.0
-
-# Calendar integration (must match main requirements)
-icalevents>=0.1.27,<1.0.0
+# Plugin-era note: timezonefinder, geopy, the google-api client stack,
+# unidecode, icalevents and python-dateutil used to live here for the
+# built-in weather/calendar/music displays. Those are store plugins now
+# and declare their own dependencies, which the plugin store installs.