diff --git a/Cargo.lock b/Cargo.lock
index 4ffff7c..0e27e96 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3093,7 +3093,7 @@ dependencies = [
  "opentelemetry_sdk",
  "proptest",
  "r2d2",
- "rand 0.8.5",
+ "rand 0.9.2",
  "reqwest",
  "rustapi-core",
  "rustapi-openapi",
diff --git a/crates/rustapi-extras/Cargo.toml b/crates/rustapi-extras/Cargo.toml
index f0f753b..be3097d 100644
--- a/crates/rustapi-extras/Cargo.toml
+++ b/crates/rustapi-extras/Cargo.toml
@@ -66,7 +66,7 @@ opentelemetry-semantic-conventions = { version = "0.31", optional = true }
 tracing-opentelemetry = { version = "0.32", optional = true }
 
 # CSRF (feature-gated)
-rand = { version = "0.8", optional = true }
+rand = { version = "0.9", optional = true }
 base64 = { version = "0.22", optional = true }
 
 # OAuth2 (feature-gated)