diff --git a/Cargo.toml b/Cargo.toml
index 62fb195..54be7b2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -34,24 +34,24 @@ path = "src/lib.rs"
 # Deliberately minimal deps for a small, focused CLI tool.
 # No hyperi-rustlib — git-scrub stands alone.
 [dependencies]
-clap = { version = "4.5", features = ["derive", "wrap_help"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+clap = { version = "4.6.7", features = ["derive", "wrap_help"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 serde_yaml_ng = "0.10"
-regex = "1.11"
-anyhow = "1.0"
-thiserror = "2.0"
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "json"] }
-tempfile = "3.13"
+regex = "1.13.1"
+anyhow = "1.0.104"
+thiserror = "2.0.21"
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt", "json"] }
+tempfile = "3.27.0"
 directories = "6.0"
-globset = "0.4"
-memchr = "2"
-toml = "1.1"
-semver = "1.0"
+globset = "0.4.20"
+memchr = "2.8.3"
+toml = "1.1.6"
+semver = "1.0.28"
 
 [dev-dependencies]
-tempfile = "3.13"
+tempfile = "3.27.0"
 
 [profile.release]
 # Smaller binary for distribution. Re-evaluate when actual runtime
diff --git a/tools/refresh-advisories/Cargo.toml b/tools/refresh-advisories/Cargo.toml
index 8fcd264..87d2f3c 100644
--- a/tools/refresh-advisories/Cargo.toml
+++ b/tools/refresh-advisories/Cargo.toml
@@ -16,16 +16,16 @@ description = "Maintainer tool: regenerate config/patterns/supply-chain.yaml fro
 publish = false
 
 [dependencies]
-anyhow = "1.0"
-reqwest = { version = "0.12", default-features = false, features = ["blocking", "rustls-tls", "json"] }
-serde = { version = "1.0", features = ["derive"] }
-serde_json = "1.0"
+anyhow = "1.0.104"
+reqwest = { version = "0.13.5", default-features = false, features = ["blocking", "rustls-tls", "json"] }
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.151"
 serde_yaml_ng = "0.10"
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
-toml = "1.1"
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter", "fmt"] }
+toml = "1.1.6"
 walkdir = "2.5"
-tempfile = "3.13"
+tempfile = "3.27.0"
 
 [[bin]]
 name = "refresh-advisories"