diff --git a/Cargo.lock b/Cargo.lock
index 2f62adf..0f40381 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1252,7 +1252,7 @@ dependencies = [
  "rustix",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "shlex",
  "tempfile",
  "thiserror 2.0.18",
diff --git a/crates/cairn/Cargo.toml b/crates/cairn/Cargo.toml
index 8eaf986..1e1af8c 100644
--- a/crates/cairn/Cargo.toml
+++ b/crates/cairn/Cargo.toml
@@ -117,7 +117,7 @@ tempfile = "3"
 # check), so no interop constraint drove the choice — `sha2` is already resolved in the workspace
 # dependency tree (pulled transitively by `wasmtime`/`cranelift` for `cairn-plugin`), so naming it
 # directly here adds no new crate, just a new consumer of one already being built.
-sha2 = "0.10"
+sha2 = "0.11"
 
 # Safe process-group kill for shell-action timeouts (no `unsafe`). Already in the dependency tree.
 [target.'cfg(unix)'.dependencies]