diff --git a/crates/octo-adapter-dingtalk/Cargo.toml b/crates/octo-adapter-dingtalk/Cargo.toml
index 1770014b..392f6c3a 100644
--- a/crates/octo-adapter-dingtalk/Cargo.toml
+++ b/crates/octo-adapter-dingtalk/Cargo.toml
@@ -18,7 +18,7 @@ base64 = "0.22"
 chrono = { version = "0.4", features = ["clock"] }
 parking_lot = "0.12"
 tracing = "0.1"
-hmac = "0.12"
+hmac = "0.13"
 sha2 = "0.10"
 
 octo-network = { path = "../octo-network" }
diff --git a/crates/octo-adapter-webhook/Cargo.toml b/crates/octo-adapter-webhook/Cargo.toml
index b0154de5..9bfbd2eb 100644
--- a/crates/octo-adapter-webhook/Cargo.toml
+++ b/crates/octo-adapter-webhook/Cargo.toml
@@ -14,7 +14,7 @@ tokio = { version = "1.35", features = ["rt-multi-thread", "macros", "time", "sy
 axum = "0.7"
 blake3 = "1.5"
 async-trait = "0.1"
-hmac = "0.12"
+hmac = "0.13"
 sha2 = "0.10"
 subtle = "2.6"
 octo-network = { path = "../octo-network" }
diff --git a/crates/octo-cable/Cargo.toml b/crates/octo-cable/Cargo.toml
index dfe8d227..70ae841f 100644
--- a/crates/octo-cable/Cargo.toml
+++ b/crates/octo-cable/Cargo.toml
@@ -31,7 +31,7 @@ p256 = { version = "0.13", features = ["ecdh"] }
 aes-gcm = "0.10"
 aes = "0.8"
 ctr = "0.9"
-hmac = "0.12"
+hmac = "0.13"
 subtle = "2"
 hkdf = "0.12"
 sha2 = "0.10"
diff --git a/crates/octo-whatsapp/Cargo.toml b/crates/octo-whatsapp/Cargo.toml
index 7efe68d9..85bac8d4 100644
--- a/crates/octo-whatsapp/Cargo.toml
+++ b/crates/octo-whatsapp/Cargo.toml
@@ -77,7 +77,7 @@ dirs = "5"
 # health/ready/metrics server + HMAC label hashing.
 prometheus = { version = "0.14", default-features = false }
 axum       = { version = "0.7", default-features = false, features = ["http1", "tokio"] }
-hmac       = "0.12"
+hmac       = "0.13"
 # Phase 5 Part F: shared reqwest::Client for the webhook action dispatcher.
 # Default features off, rustls-tls only — keeps hermetic builds linkable
 # without OpenSSL.
diff --git a/crates/quota-router-core/Cargo.toml b/crates/quota-router-core/Cargo.toml
index 8801353e..b058185a 100644
--- a/crates/quota-router-core/Cargo.toml
+++ b/crates/quota-router-core/Cargo.toml
@@ -53,7 +53,7 @@ stoolap = { git = "https://github.com/CipherOcto/stoolap", branch = "feat/blockc
 hmac-sha256 = "1.1"
 
 # For HMAC (AWS SigV4 signing)
-hmac = "0.12"
+hmac = "0.13"
 
 # For bincode serialization (mesh envelope wire format)
 bincode = "1"