diff --git a/Cargo.lock b/Cargo.lock
index a33f1307a09..e364a884160 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4983,9 +4983,9 @@ dependencies = [
 
 [[package]]
 name = "sha2"
-version = "0.10.8"
+version = "0.10.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "793db75ad2bcafc3ffa7c68b215fee268f537982cd901d132f89c6343f3a3dc8"
+checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures",
diff --git a/Cargo.toml b/Cargo.toml
index 67be837d2d9..58d1557b1d1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -116,7 +116,7 @@ semver = { version = "=1.0.26", features = ["serde"] }
 sentry = { version = "=0.37.0", features = ["tracing", "tower", "tower-axum-matched-path", "tower-http"] }
 serde = { version = "=1.0.219", features = ["derive"] }
 serde_json = "=1.0.140"
-sha2 = "=0.10.8"
+sha2 = "=0.10.9"
 spdx = "=0.10.8"
 tar = "=0.4.44"
 tempfile = "=3.19.1"
diff --git a/crates/crates_io_database/Cargo.toml b/crates/crates_io_database/Cargo.toml
index dd2624a1a11..7c13d9c9cfc 100644
--- a/crates/crates_io_database/Cargo.toml
+++ b/crates/crates_io_database/Cargo.toml
@@ -21,7 +21,7 @@ secrecy = "=0.10.3"
 semver = { version = "=1.0.26", features = ["serde"] }
 serde = { version = "=1.0.219", features = ["derive"] }
 serde_json = "=1.0.140"
-sha2 = "=0.10.8"
+sha2 = "=0.10.9"
 thiserror = "=2.0.12"
 tracing = "=0.1.41"
 unicode-xid = "=0.2.6"