diff --git a/Cargo.lock b/Cargo.lock
index 783ce3f..b07dd1f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4667,7 +4667,7 @@ dependencies = [
  "ct-codecs",
  "ecdsa",
  "ed25519-compact",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "hex",
  "hmac-sha256",
  "keyring",
@@ -4715,7 +4715,7 @@ dependencies = [
  "chrono",
  "ct-codecs",
  "ed25519-compact",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "hex",
  "in_toto_attestation",
  "serde",
@@ -4760,7 +4760,7 @@ version = "0.11.0"
 dependencies = [
  "ct-codecs",
  "ed25519-compact",
- "getrandom 0.3.4",
+ "getrandom 0.4.2",
  "hmac-sha256",
  "log",
  "thiserror 2.0.20",
diff --git a/src/attestation/Cargo.toml b/src/attestation/Cargo.toml
index 6e70c53..11c0848 100644
--- a/src/attestation/Cargo.toml
+++ b/src/attestation/Cargo.toml
@@ -18,7 +18,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 chrono = { version = "0.4", default-features = false, features = ["std", "clock"] }
 hex = "0.4"
-getrandom = "0.3"
+getrandom = "0.4"
 sha2 = "0.10"  # Proper SHA-256 for artifact hashing
 base64 = "0.22"  # DSSE envelope encoding
 
diff --git a/src/lib/Cargo.toml b/src/lib/Cargo.toml
index 0a48831..1cacfec 100644
--- a/src/lib/Cargo.toml
+++ b/src/lib/Cargo.toml
@@ -23,7 +23,7 @@ wsc-dsse = { version = "0.11.0", path = "../dsse" }
 anyhow = "1.0.100"
 ct-codecs = "1.1.6"
 ed25519-compact = { version = "2.1.1", features = ["pem"] }
-getrandom = { version = "0.3.4", features = ["wasm_js"] }
+getrandom = { version = "0.4.2", features = ["wasm_js"] }
 hmac-sha256 = "1.1.12"
 log = "0.4.28"
 # Structured audit logging
diff --git a/src/verify-core/Cargo.toml b/src/verify-core/Cargo.toml
index 1fe4a18..c9fc3e2 100644
--- a/src/verify-core/Cargo.toml
+++ b/src/verify-core/Cargo.toml
@@ -14,7 +14,7 @@ categories = ["cryptography", "wasm", "no-std"]
 [dependencies]
 ct-codecs = "1.1.6"
 ed25519-compact = { version = "2.1.1", features = ["pem"] }
-getrandom = { version = "0.3.4", features = ["wasm_js"] }
+getrandom = { version = "0.4.2", features = ["wasm_js"] }
 hmac-sha256 = "1.1.12"
 log = "0.4.28"
 thiserror = "2.0.17"