diff --git a/Cargo.lock b/Cargo.lock
index 2ac638cd1..f0dded48e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -71,7 +71,7 @@ dependencies = [
  "cfg-if",
  "once_cell",
  "version_check",
- "zerocopy",
+ "zerocopy 0.7.35",
 ]
 
 [[package]]
@@ -707,7 +707,7 @@ checksum = "2b1866ecef4f2d06a0bb77880015fdf2b89e25a1c2e5addacb87e459c86dc67e"
 dependencies = [
  "base64 0.22.1",
  "blowfish",
- "getrandom",
+ "getrandom 0.2.15",
  "subtle",
  "zeroize",
 ]
@@ -1377,7 +1377,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
  "zeroize",
 ]
@@ -1389,7 +1389,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1bfb12502f3fc46cca1bb51ac28df9d618d813cdc3d2f25b9fe775a34af26bb3"
 dependencies = [
  "generic-array",
- "rand_core",
+ "rand_core 0.6.4",
  "typenum",
 ]
 
@@ -1671,7 +1671,7 @@ dependencies = [
  "hkdf",
  "pem-rfc7468",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "sec1",
  "subtle",
  "zeroize",
@@ -1812,7 +1812,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ded41244b729663b1e574f1b4fb731469f69f79c17667b5d776b16cda0479449"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -2038,10 +2038,22 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "71393ecc86efbf00e4ca13953979ba8b94cfe549a4b74cc26d8b62f4d8feac2b"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.13.3+wasi-0.2.2",
+ "windows-targets 0.52.6",
+]
+
 [[package]]
 name = "ghash"
 version = "0.5.1"
@@ -2109,7 +2121,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
  "ff",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -3176,7 +3188,7 @@ dependencies = [
  "opentelemetry_sdk",
  "prometheus",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "reqwest",
  "rustls",
  "sentry",
@@ -3215,7 +3227,7 @@ dependencies = [
  "mas-keystore",
  "pem-rfc7468",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "rustls-pemfile",
  "rustls-pki-types",
  "schemars",
@@ -3239,7 +3251,7 @@ dependencies = [
  "mas-jose",
  "oauth2-types",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "regex",
  "ruma-common",
  "serde",
@@ -3311,7 +3323,7 @@ dependencies = [
  "pkcs8",
  "psl",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "reqwest",
  "rustls",
  "schemars",
@@ -3434,7 +3446,7 @@ dependencies = [
  "p256",
  "p384",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "rsa",
  "schemars",
  "sec1",
@@ -3468,7 +3480,7 @@ dependencies = [
  "pkcs1",
  "pkcs8",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "rsa",
  "sec1",
  "spki",
@@ -3548,7 +3560,7 @@ dependencies = [
  "oauth2-types",
  "p256",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "reqwest",
  "rustls",
  "serde",
@@ -3609,7 +3621,7 @@ dependencies = [
  "mas-jose",
  "oauth2-types",
  "opentelemetry",
- "rand_core",
+ "rand_core 0.6.4",
  "serde",
  "serde_json",
  "thiserror 2.0.11",
@@ -3633,7 +3645,7 @@ dependencies = [
  "oauth2-types",
  "opentelemetry-semantic-conventions",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "sea-query",
  "sea-query-binder",
  "serde_json",
@@ -3664,7 +3676,7 @@ dependencies = [
  "opentelemetry",
  "opentelemetry-semantic-conventions",
  "rand",
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "serde",
  "serde_json",
  "sqlx",
@@ -3828,7 +3840,7 @@ checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
  "hermit-abi 0.3.9",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.52.0",
 ]
 
@@ -4290,7 +4302,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
  "base64ct",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -4511,7 +4523,7 @@ checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
  "der",
  "pkcs5",
- "rand_core",
+ "rand_core 0.6.4",
  "spki",
 ]
 
@@ -4589,7 +4601,7 @@ version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.7.35",
 ]
 
 [[package]]
@@ -4731,7 +4743,7 @@ dependencies = [
  "libc",
  "once_cell",
  "raw-cpuid",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "web-sys",
  "winapi",
 ]
@@ -4761,7 +4773,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a2fe5ef3495d7d2e377ff17b1a8ce2ee2ec2a18cde8b6ad6619d65d0701c135d"
 dependencies = [
  "bytes",
- "getrandom",
+ "getrandom 0.2.15",
  "rand",
  "ring",
  "rustc-hash 2.0.0",
@@ -4810,8 +4822,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -4821,7 +4833,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.0",
 ]
 
 [[package]]
@@ -4830,7 +4852,17 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b08f3c9802962f7e1b25113931d94f43ed9725bebc59db9d0c3e9a23b67e15ff"
+dependencies = [
+ "getrandom 0.3.0",
+ "zerocopy 0.8.14",
 ]
 
 [[package]]
@@ -5001,7 +5033,7 @@ checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom",
+ "getrandom 0.2.15",
  "libc",
  "spin",
  "untrusted",
@@ -5021,7 +5053,7 @@ dependencies = [
  "num-traits",
  "pkcs1",
  "pkcs8",
- "rand_core",
+ "rand_core 0.6.4",
  "signature",
  "spki",
  "subtle",
@@ -5701,7 +5733,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
 dependencies = [
  "digest",
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
@@ -6795,6 +6827,15 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
+[[package]]
+name = "wasi"
+version = "0.13.3+wasi-0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
 [[package]]
 name = "wasite"
 version = "0.1.0"
@@ -7399,6 +7440,15 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+dependencies = [
+ "bitflags 2.8.0",
+]
+
 [[package]]
 name = "wit-parser"
 version = "0.218.0"
@@ -7476,7 +7526,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
  "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a367f292d93d4eab890745e75a778da40909cab4d6ff8173693812f79c4a2468"
+dependencies = [
+ "zerocopy-derive 0.8.14",
 ]
 
 [[package]]
@@ -7490,6 +7549,17 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3931cb58c62c13adec22e38686b559c86a30565e16ad6e8510a337cedc611e1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.5"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 5c5039d39..f47ce3661 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -29,7 +29,7 @@ ipnetwork = "0.20.0"
 itertools = "0.13.0"
 listenfd = "1.0.2"
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 reqwest.workspace = true
 rustls.workspace = true
 serde_json.workspace = true
diff --git a/crates/config/Cargo.toml b/crates/config/Cargo.toml
index 4a89fdd89..e871670cf 100644
--- a/crates/config/Cargo.toml
+++ b/crates/config/Cargo.toml
@@ -33,7 +33,7 @@ pem-rfc7468 = "0.7.0"
 rustls-pki-types = "1.10.1"
 rustls-pemfile = "2.2.0"
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 
 indoc = "2.0.5"
 
diff --git a/crates/data-model/Cargo.toml b/crates/data-model/Cargo.toml
index ee49a6c05..59c8c1762 100644
--- a/crates/data-model/Cargo.toml
+++ b/crates/data-model/Cargo.toml
@@ -21,7 +21,7 @@ url.workspace = true
 crc = "3.2.1"
 ulid.workspace = true
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 regex = "1.11.1"
 woothee = "0.13.0"
 ruma-common = "0.15.0"
diff --git a/crates/handlers/Cargo.toml b/crates/handlers/Cargo.toml
index 898eb0c7c..8c3ec8248 100644
--- a/crates/handlers/Cargo.toml
+++ b/crates/handlers/Cargo.toml
@@ -82,7 +82,7 @@ mime = "0.3.17"
 minijinja.workspace = true
 minijinja-contrib.workspace = true
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 headers.workspace = true
 ulid.workspace = true
 
diff --git a/crates/jose/Cargo.toml b/crates/jose/Cargo.toml
index f2a9ec629..2326def78 100644
--- a/crates/jose/Cargo.toml
+++ b/crates/jose/Cargo.toml
@@ -38,4 +38,4 @@ mas-iana.workspace = true
 
 [dev-dependencies]
 insta.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
diff --git a/crates/keystore/Cargo.toml b/crates/keystore/Cargo.toml
index d81c8b58e..2bba8d491 100644
--- a/crates/keystore/Cargo.toml
+++ b/crates/keystore/Cargo.toml
@@ -36,4 +36,4 @@ mas-jose.workspace = true
 
 [dev-dependencies]
 insta.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
diff --git a/crates/oidc-client/Cargo.toml b/crates/oidc-client/Cargo.toml
index 43ec23714..4280fb932 100644
--- a/crates/oidc-client/Cargo.toml
+++ b/crates/oidc-client/Cargo.toml
@@ -40,7 +40,7 @@ oauth2-types.workspace = true
 [dev-dependencies]
 assert_matches = "1.5.0"
 bitflags = "2.8.0"
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 tokio.workspace = true
 wiremock.workspace = true
 http-body-util.workspace = true
diff --git a/crates/storage-pg/Cargo.toml b/crates/storage-pg/Cargo.toml
index f0103be6e..0dc864e63 100644
--- a/crates/storage-pg/Cargo.toml
+++ b/crates/storage-pg/Cargo.toml
@@ -24,7 +24,7 @@ futures-util.workspace = true
 opentelemetry-semantic-conventions.workspace = true
 
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 url.workspace = true
 uuid = "1.12.1"
 ulid = { workspace = true, features = ["uuid"] }
diff --git a/crates/tasks/Cargo.toml b/crates/tasks/Cargo.toml
index 3b57e296f..0297273f3 100644
--- a/crates/tasks/Cargo.toml
+++ b/crates/tasks/Cargo.toml
@@ -17,7 +17,7 @@ async-trait.workspace = true
 cron.workspace = true
 chrono.workspace = true
 rand.workspace = true
-rand_chacha = "0.3.1"
+rand_chacha = "0.9.0"
 sqlx.workspace = true
 thiserror.workspace = true
 tokio.workspace = true