diff --git a/Cargo.lock b/Cargo.lock
index 20e2151a7..be7be0dcc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -344,6 +344,17 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ciborium"
 version = "0.2.2"
@@ -928,6 +939,7 @@ dependencies = [
  "js-sys",
  "libc",
  "r-efi",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
  "wasm-bindgen",
@@ -1475,8 +1487,8 @@ dependencies = [
  "liblzma",
  "password-hash",
  "pbkdf2 0.12.2",
- "rand",
- "rand_chacha",
+ "rand 0.10.1",
+ "rand_chacha 0.10.0",
  "time",
  "tokio",
  "tokio-util",
@@ -1774,7 +1786,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
  "base64ct",
- "rand_core",
+ "rand_core 0.6.4",
  "subtle",
 ]
 
@@ -1917,7 +1929,7 @@ dependencies = [
  "path-slash",
  "pna",
  "predicates",
- "rand",
+ "rand 0.10.1",
  "rayon",
  "regex",
  "rust-embed",
@@ -2040,8 +2052,8 @@ dependencies = [
  "bitflags",
  "lazy_static",
  "num-traits",
- "rand",
- "rand_chacha",
+ "rand 0.8.6",
+ "rand_chacha 0.3.1",
  "rand_xorshift",
  "regex-syntax",
  "unarray",
@@ -2080,8 +2092,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.1",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -2091,7 +2114,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3e6af7f3e25ded52c41df4e0b1af2d047e45896c2f3281792ed68a1c243daedb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -2103,13 +2136,19 @@ dependencies = [
  "getrandom 0.2.15",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_xorshift"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d25bf25ec5ae4a3f1b92f929810509a2f53d7dca2f50b794ff57e3face536c8f"
 dependencies = [
- "rand_core",
+ "rand_core 0.6.4",
 ]
 
 [[package]]
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index fb494a789..f8f05ce75 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -48,7 +48,7 @@ tabled = { version = "0.20.0", default-features = false, features = ["std", "ans
 termtree = "0.5"
 thiserror = "2.0.18"
 typed-path = "0.12"
-rand = "0.8.6"
+rand = "0.10.1"
 walkdir = "2.5.0"
 
 [target.'cfg(not(target_family = "wasm"))'.dependencies]
diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index 4a4fcef9e..5d86a6f2e 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -29,8 +29,8 @@ futures-util = { version = "0.3.32", features = ["io"], optional = true }
 liblzma = { version = "0.4.6", features = ["static"] }
 password-hash = { version = "0.5.0", default-features = false }
 pbkdf2 = { version = "0.12.2", features = ["simple"] }
-rand = "0.8.6"
-rand_chacha = "0.3.1"
+rand = "0.10.1"
+rand_chacha = "0.10.0"
 time = "0.3.47"
 zstd = { version = "0.13.3", default-features = false }