diff --git a/Cargo.lock b/Cargo.lock
index 94425633..8b94ca80 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4707,7 +4707,7 @@ name = "ministr-app"
 version = "0.7.0"
 dependencies = [
  "fastembed",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "keyring",
  "ministr-api",
  "ministr-core",
@@ -4738,7 +4738,7 @@ dependencies = [
  "clap",
  "dialoguer",
  "futures",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "miette",
  "ministr-api",
  "ministr-core",
diff --git a/ministr-app/src-tauri/Cargo.toml b/ministr-app/src-tauri/Cargo.toml
index d1b3c8ce..a576fdde 100644
--- a/ministr-app/src-tauri/Cargo.toml
+++ b/ministr-app/src-tauri/Cargo.toml
@@ -45,7 +45,7 @@ sha2 = { workspace = true }
 # nanos shim did not meet that bar. `getrandom::fill` delegates to the
 # platform RNG (getrandom(2) on Linux, SecRandomCopyBytes on macOS,
 # BCryptGenRandom on Windows).
-getrandom = "0.3"
+getrandom = "0.4"
 # F1.3 OS-keychain carry-over — bearer token storage moves out of plain
 # `<data-dir>/cloud.json` and into the OS-native credential store
 # (Keychain on macOS, secret-service on Linux, Credential Manager on
diff --git a/ministr-cli/Cargo.toml b/ministr-cli/Cargo.toml
index 868d47b4..bfe23918 100644
--- a/ministr-cli/Cargo.toml
+++ b/ministr-cli/Cargo.toml
@@ -52,7 +52,7 @@ rustls.workspace = true
 # CSPRNG (RFC 7636 §4.1) and serialises a few small response
 # envelopes off the wire.
 serde = { workspace = true }
-getrandom = "0.3"
+getrandom = "0.4"
 clap.workspace = true
 rmcp.workspace = true
 axum.workspace = true