diff --git a/Cargo.lock b/Cargo.lock
index bb1a97c..78ee89e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -103,6 +103,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
@@ -745,9 +751,9 @@ dependencies = [
 
 [[package]]
 name = "globset"
-version = "0.4.18"
+version = "0.4.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52dfc19153a48bde0cbd630453615c8151bce3a5adfac7a0aebfbf0a1e1f57e3"
+checksum = "07c34a9410465b45bd9787443bc7370f37735bad04b0f0cd57ff1a3186c98988"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -760,7 +766,7 @@ dependencies = [
 name = "gommage-audit"
 version = "0.7.5-alpha.1"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "ed25519-dalek",
  "gommage-core",
  "hex",
@@ -808,7 +814,7 @@ dependencies = [
 name = "gommage-core"
 version = "0.18.1-alpha.1"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "dirs",
  "ed25519-dalek",
  "globset",
@@ -1062,9 +1068,9 @@ dependencies = [
 
 [[package]]
 name = "libsqlite3-sys"
-version = "0.38.1"
+version = "0.38.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6c19a05435c21ac299d71b6a9c13db3e3f47c520517d58990a462a1397a61db"
+checksum = "f1d20bef17f513b9b3004532233187769cd072d790971f4e4da0e346eb6401e8"
 dependencies = [
  "cc",
  "pkg-config",
@@ -1697,9 +1703,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.4"
+version = "1.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
+checksum = "f020237b6c8eed93db2e2cb53c00c60a8e1bc73da7d073199a1180401450218d"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1709,9 +1715,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.14"
+version = "0.4.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e1dd4122fc1595e8162618945476892eefca7b88c52820e74af6262213cae8f"
+checksum = "ad8553b9b26413251cbf30e620595c7a41b3887f03da04579c0e6b0d6a06b4b2"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -1736,9 +1742,9 @@ dependencies = [
 
 [[package]]
 name = "rusqlite"
-version = "0.40.1"
+version = "0.40.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11438310b19e3109b6446c33d1ed5e889428cf2e278407bc7896bc4aaea43323"
+checksum = "23f2a97da3e3873c73cb2a2e71b35c40ff95e0b1eefa8d72d8499a6928c3b5b3"
 dependencies = [
  "bitflags 2.13.0",
  "fallible-iterator",
@@ -2100,7 +2106,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4676b37242ccbd1aabf56edb093a4827dc49086c0ffd764a5705899e0f35f8f7"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.22.1",
  "bitflags 2.13.0",
  "fancy-regex",
  "filedescriptor",
@@ -2186,9 +2192,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.51"
+version = "0.3.55"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85c17d80feb7334b40c484e45ed1a5273dfd8bfda537c3be2e74a06a6686f327"
+checksum = "cdb87b95ec50ddfa440816d227a17b2ccbdda963a316a727fda0fc4334f7d134"
 dependencies = [
  "deranged",
  "libc",
@@ -2208,9 +2214,9 @@ checksum = "9e1c906769ad99c88eaa54e728060edef082f8e358ff32030cb7c7d315e81109"
 
 [[package]]
 name = "time-macros"
-version = "0.2.30"
+version = "0.2.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcef1a61bdb119096e153208ec5cbec23944ce8bca13be5c7f60c634f7403935"
+checksum = "7e689342a48d2ea927c87ea50cabf8594854bf940e9310208848d680d668ed85"
 dependencies = [
  "num-conv",
  "time-core",
@@ -2421,9 +2427,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.23.4"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf80a72845275afea99e7f2b434723d3bc7e38470fcd1c7ed39a599c73319a53"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
  "atomic",
  "getrandom 0.4.2",
diff --git a/Cargo.toml b/Cargo.toml
index ffc8ef3..a0a767b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -43,16 +43,16 @@ ratatui    = "0.30"
 
 # --- Determinism-critical (exact pins: any change here can flip a decision) -
 # Touching any of these requires a PR with a green determinism-suite run.
-globset       = "=0.4.18"
-regex         = "=1.12.4"
+globset       = "=0.4.20"
+regex         = "=1.13.1"
 ed25519-dalek = { version = "=2.2.0", features = ["rand_core", "std"] }
 rand_core     = { version = "=0.6.4", features = ["std"] }
-rusqlite      = { version = "=0.40.1", features = ["bundled"] }
+rusqlite      = { version = "=0.40.2", features = ["bundled"] }
 sha2          = "=0.11.0"
 hex           = "=0.4.3"
-base64        = "=0.22.1"
-time          = { version = "=0.3.51", features = ["serde", "formatting", "parsing", "macros"] }
-uuid          = { version = "=1.23.4", features = ["v7", "serde"] }
+base64        = "=0.23.1"
+time          = { version = "=0.3.55", features = ["serde", "formatting", "parsing", "macros"] }
+uuid          = { version = "=1.26.0", features = ["v7", "serde"] }
 
 # serde_yaml migrated to serde_yaml_ng (maintained fork, drop-in API
 # compatible). Aliased so every `use serde_yaml::*` in-tree keeps working