diff --git a/crates/e2e-tests/Cargo.toml b/crates/e2e-tests/Cargo.toml
index 04dfb1c..fb647d1 100644
--- a/crates/e2e-tests/Cargo.toml
+++ b/crates/e2e-tests/Cargo.toml
@@ -21,7 +21,7 @@ anyhow = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 uuid = { version = "1", features = ["v4"] }
-rusqlite = { version = "0.32", features = ["bundled"] }
+rusqlite = { version = "0.39", features = ["bundled"] }
 axum = "0.8"
 
 [lints]
diff --git a/crates/tokf-cli/Cargo.toml b/crates/tokf-cli/Cargo.toml
index bd0fef6..f9972e1 100644
--- a/crates/tokf-cli/Cargo.toml
+++ b/crates/tokf-cli/Cargo.toml
@@ -28,7 +28,7 @@ include_dir = { version = "0.7", features = ["glob"] }
 # Pinned to 0.32.x: uses libsqlite3-sys ^0.30.1, same as sqlx-sqlite in tokf-server.
 # Upgrading rusqlite past 0.32.x would require a newer libsqlite3-sys that conflicts
 # with sqlx-sqlite's links = "sqlite3" constraint in the workspace resolver.
-rusqlite = { version = "0.32", features = ["bundled"] }
+rusqlite = { version = "0.39", features = ["bundled"] }
 rkyv = { version = "0.8", features = ["bytecheck", "unaligned"] }
 reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "blocking", "multipart", "query"] }
 # linux-native uses kernel keyutils (no libdbus-sys dependency).
diff --git a/crates/tokf-common/Cargo.toml b/crates/tokf-common/Cargo.toml
index ce21fb9..73d1508 100644
--- a/crates/tokf-common/Cargo.toml
+++ b/crates/tokf-common/Cargo.toml
@@ -12,7 +12,7 @@ categories = ["command-line-utilities", "development-tools"]
 [dependencies]
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-sha2 = "0.10"
+sha2 = "0.11"
 toml = { version = "1.0", optional = true }
 regex = { version = "1", optional = true }
 unicode-normalization = "0.1"
diff --git a/crates/tokf-server/Cargo.toml b/crates/tokf-server/Cargo.toml
index 687b10c..f7233c6 100644
--- a/crates/tokf-server/Cargo.toml
+++ b/crates/tokf-server/Cargo.toml
@@ -27,8 +27,8 @@ clap = { version = "4", features = ["derive"] }
 sqlx = { version = "=0.8.6", default-features = false, features = ["postgres", "runtime-tokio-rustls", "uuid", "chrono", "macros", "migrate"] }
 uuid = { version = "1", features = ["v4", "serde"] }
 reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "form"] }
-sha2 = "0.10"
-rand = "0.9"
+sha2 = "0.11"
+rand = "0.10"
 hex = "0.4"
 async-trait = "0.1"
 chrono = { version = "0.4", features = ["serde"] }