diff --git a/Cargo.toml b/Cargo.toml
index 8ccf670b..81dee5df 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -95,7 +95,7 @@ directories = "6"
 # Async mutex
 parking_lot = "0.12"
 # Random number generation
-rand = "0.9"
+rand = "0.10"
 # Gzip compression (mission 0850p-a-session-export)
 flate2 = "1"
 # Bitflags (mission 0855p-c-sub-admins SubAdminAuthority)
diff --git a/crates/octo-adapter-nostr/Cargo.toml b/crates/octo-adapter-nostr/Cargo.toml
index 03286f1d..1d2bb59f 100644
--- a/crates/octo-adapter-nostr/Cargo.toml
+++ b/crates/octo-adapter-nostr/Cargo.toml
@@ -16,6 +16,6 @@ blake3 = "1.5"
 ed25519-dalek = { version = "2.1", features = ["serde"] }
 sha2 = "0.10"
 base64 = "0.22"
-rand = "0.8"
+rand = "0.10"
 async-trait = "0.1"
 octo-network = { path = "../octo-network" }
diff --git a/crates/octo-adapter-whatsapp/Cargo.toml b/crates/octo-adapter-whatsapp/Cargo.toml
index eaee626a..02ff5f0d 100644
--- a/crates/octo-adapter-whatsapp/Cargo.toml
+++ b/crates/octo-adapter-whatsapp/Cargo.toml
@@ -118,7 +118,7 @@ webpki-roots = "0.26"
 # X25519 for the ephemeral static pub we put in frame[0]. Wacore pins
 # x25519-dalek 2.0.1 in the lockfile (see Cargo.lock); pin the same major.
 x25519-dalek = { version = "2", features = ["static_secrets"] }
-rand = "0.8"
+rand = "0.10"
 
 [dev-dependencies]
 tempfile = "3"
diff --git a/crates/octo-cable/Cargo.toml b/crates/octo-cable/Cargo.toml
index dfe8d227..7d909e33 100644
--- a/crates/octo-cable/Cargo.toml
+++ b/crates/octo-cable/Cargo.toml
@@ -35,7 +35,7 @@ hmac = "0.12"
 subtle = "2"
 hkdf = "0.12"
 sha2 = "0.10"
-rand = "0.8"
+rand = "0.10"
 
 # Session 15: BLE service-data advertiser for caBLE v2 phase 2.
 # The caBLE v2 protocol carries the encrypted Eid (containing our
diff --git a/crates/octo-network/Cargo.toml b/crates/octo-network/Cargo.toml
index f82cc9cb..8067463f 100644
--- a/crates/octo-network/Cargo.toml
+++ b/crates/octo-network/Cargo.toml
@@ -22,7 +22,7 @@ chacha20poly1305 = "0.10"
 libloading = "0.8"
 wasmtime = { version = "36.0", optional = true }
 # Mission 0850p-d: nonce generation for DcOrchestrator
-rand = "0.9"
+rand = "0.10"
 
 # Stoolap Data Sync (RFC-0862) — leaf workspace dependency
 octo-sync = { path = "../../octo-sync" }
diff --git a/crates/quota-router-integration-tests/Cargo.toml b/crates/quota-router-integration-tests/Cargo.toml
index 22589faa..b8633d3a 100644
--- a/crates/quota-router-integration-tests/Cargo.toml
+++ b/crates/quota-router-integration-tests/Cargo.toml
@@ -14,7 +14,7 @@ tokio = { version = "1", features = ["macros", "rt-multi-thread", "time", "sync"
 async-trait = "0.1"
 bincode = "1"
 blake3 = "1.5"
-rand = "0.8"
+rand = "0.10"
 
 [dev-dependencies]
 hex = "0.4"