diff --git a/integ/failure-server/Cargo.toml b/integ/failure-server/Cargo.toml
index 3057c738..4346ee15 100644
--- a/integ/failure-server/Cargo.toml
+++ b/integ/failure-server/Cargo.toml
@@ -7,14 +7,14 @@ license = "MIT OR Apache-2.0"
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-axum = "0.6"
+axum = "0.8"
 anyhow = "1"
 noxious-client = "1"
-rand = "0.8"
+rand = "0.10"
 serde_json = "1"
 tempfile = "3"
 tokio = "1"
 tokio-retry = "0.3"
-tower = { version = "0.4", features = ["util"] }
+tower = { version = "0.5", features = ["util"] }
 tower-fault = "0.0.5"
-tower-http = { version = "0.4", features = ["fs"] }
+tower-http = { version = "0.7", features = ["fs"] }
diff --git a/tough-kms/Cargo.toml b/tough-kms/Cargo.toml
index 29757ae5..77c25047 100644
--- a/tough-kms/Cargo.toml
+++ b/tough-kms/Cargo.toml
@@ -19,14 +19,14 @@ tough = { version = "0.19", path = "../tough", features = ["http"] }
 aws-lc-rs = "1"
 aws-sdk-kms = "1"
 aws-config = { version = "1", default-features = false, features = ["credentials-process"] }
-aws-smithy-experimental = { version = "0.1", features = ["crypto-aws-lc"] }
-snafu = { version = "0.8", features = ["backtraces-impl-backtrace-crate"] }
+aws-smithy-experimental = { version = "0.2", features = ["crypto-aws-lc"] }
+snafu = { version = "0.9", features = ["backtraces-impl-backtrace-crate"] }
 tokio = { version = "1", features = ["fs", "io-util", "time", "macros", "rt-multi-thread"] }
 pem = "3"
 
 [dev-dependencies]
 aws-smithy-runtime = { version = "1", features = ["test-util"] }
-aws-smithy-http = "0.60"
+aws-smithy-http = "0.63"
 aws-smithy-types = "1"
 base64 = "0.22"
 bytes = "1"
diff --git a/tough-ssm/Cargo.toml b/tough-ssm/Cargo.toml
index 404ac0cd..a4629be1 100644
--- a/tough-ssm/Cargo.toml
+++ b/tough-ssm/Cargo.toml
@@ -18,6 +18,6 @@ fips = ["tough/fips"]
 tough = { version = "0.19", path = "../tough", features = ["http"] }
 aws-sdk-ssm = "1"
 aws-config = { version = "1", default-features = false, features = ["credentials-process"] }
-aws-smithy-experimental = { version = "0.1", features = ["crypto-aws-lc"] }
-snafu = { version = "0.8", features = ["backtraces-impl-backtrace-crate"] }
+aws-smithy-experimental = { version = "0.2", features = ["crypto-aws-lc"] }
+snafu = { version = "0.9", features = ["backtraces-impl-backtrace-crate"] }
 tokio = { version = "1", features = ["fs", "io-util", "time", "macros", "rt-multi-thread"] }
diff --git a/tough/Cargo.toml b/tough/Cargo.toml
index 511c53de..fd48932e 100644
--- a/tough/Cargo.toml
+++ b/tough/Cargo.toml
@@ -23,22 +23,22 @@ log = "0.4"
 olpc-cjson = { version = "0.1", path = "../olpc-cjson" }
 pem = "3"
 percent-encoding = "2"
-reqwest = { version = "0.12", optional = true, default-features = false, features = ["stream"] }
+reqwest = { version = "0.13", optional = true, default-features = false, features = ["stream"] }
 rustls = "0.23"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_plain = "1"
-snafu = { version = "0.8", features = ["futures"] }
+snafu = { version = "0.9", features = ["futures"] }
 tempfile = "3"
 tokio = { version = "1", default-features = false, features = ["io-util", "sync", "fs", "rt", "time"] }
 tokio-util = { version = "0.7", features = ["io"] }
-typed-path = "0.9"
+typed-path = "0.12"
 # pinned due to aws-lc-rs locked to this version
 # https://github.com/aws/aws-lc-rs/issues/468
-untrusted = "0.7.1"
+untrusted = "0.9.0"
 url = "2"
 walkdir = "2"
-itertools = "0.13.0"
+itertools = "0.15.0"
 indexmap = { version = "2.5.0", features = ["serde"] }
 
 [dev-dependencies]
diff --git a/tuftool/Cargo.toml b/tuftool/Cargo.toml
index cddced6a..16670cf6 100644
--- a/tuftool/Cargo.toml
+++ b/tuftool/Cargo.toml
@@ -38,18 +38,18 @@ maplit = "1"
 olpc-cjson = { version = "0.1", path = "../olpc-cjson" }
 openssl = { version = "0.10.40" }
 rayon = "1"
-reqwest = { version = "0.12", default-features = false, features = ["rustls-tls-native-roots"] }
+reqwest = { version = "0.13", default-features = false, features = ["rustls-tls-native-roots"] }
 rustls = "0.23"
 serde = "1"
 serde_json = "1"
 serial_test = "3.1.1"
 simplelog = "0.12"
 
-sigstore_protobuf_specs = { version = "0.4", default-features = false, optional = true }
+sigstore_protobuf_specs = { version = "0.5", default-features = false, optional = true }
 
-snafu = { version = "0.8", features = ["backtraces-impl-backtrace-crate"] }
+snafu = { version = "0.9", features = ["backtraces-impl-backtrace-crate"] }
 pem = "3.0.4"
-prost-types = "0.13.5"
+prost-types = "0.14.0"
 tempfile = "3"
 tokio = { version = "1", features = ["macros", "rt", "rt-multi-thread"] }
 tough = { version = "0.19", path = "../tough", features = ["http"] }
@@ -59,13 +59,13 @@ url = "2"
 walkdir = "2"
 indexmap = { version = "2.5.0", features = ["serde"] }
 
-rustls-webpki = { version = "0.102.1", features = ["alloc"] }
+rustls-webpki = { version = "0.103.0", features = ["alloc"] }
 thiserror = "1.0.30"
 base64 = { version = "0.22", default-features = false, features = ["std"] }
 futures-util = { version = "0.3.30", optional = true }
 tokio-util = { version = "0.7.10", features = ["io-util"] }
 tracing = "0.1.31"
-rstest = "0.22.0"
+rstest = "0.26.0"
 regex = { version = "1.5.5", optional = true }
 pki-types = { package = "rustls-pki-types", version = "1.12", default-features = false }