diff --git a/Cargo.lock b/Cargo.lock
index bd41fd36..0bf66f3a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1845,9 +1845,9 @@ dependencies = [
 
 [[package]]
 name = "hyper"
-version = "1.11.1"
+version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "27b501faa50e7a26c3d3560ca625132f4078a17771f4810baf70475ae48cbe43"
+checksum = "2c3e324da4c95177d6291d4c8730197c0d1822f8a9766814a4a44fa5ab797c9c"
 dependencies = [
  "atomic-waker",
  "bytes",
@@ -3615,9 +3615,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.154"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "e7e9cc8b1b85264074fbcc02a88680c4096b1e47df8f739dceb03bf482f04bd6"
 dependencies = [
  "itoa",
  "memchr",
@@ -5020,9 +5020,9 @@ dependencies = [
 
 [[package]]
 name = "uuid"
-version = "1.27.0"
+version = "1.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97277d36b9c3ace13e58fa6e753f8b0bbbf302a18dd193240d70f9e29681059a"
+checksum = "7cc1186384beb7dd8eedea376413fd654937285ea6c9cfbb928dc3043ea4b606"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
diff --git a/Cargo.toml b/Cargo.toml
index f01ba91c..bad86fdf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -76,18 +76,18 @@ tw-dialect = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git",
 tw-guard = { git = "https://github.com/ThinkWatchProject/ThinkWatch-Core.git", tag = "v0.70.0" }
 
 # Web framework
-axum = { version = "0.8", features = ["macros", "ws"] }
-tower = "0.5"
-tower-http = { version = "0.7", features = [
+axum = { version = "0.8.9", features = ["macros", "ws"] }
+tower = "0.5.3"
+tower-http = { version = "0.7.1", features = [
     "cors", "trace", "compression-gzip", "request-id",
     "limit", "timeout", "catch-panic", "sensitive-headers", "set-header",
 ] }
-tokio = { version = "1", features = ["rt-multi-thread", "macros", "net", "time", "sync", "io-util", "signal"] }
+tokio = { version = "1.53.2", features = ["rt-multi-thread", "macros", "net", "time", "sync", "io-util", "signal"] }
 
 # Database
 sqlx = { version = "0.9", features = ["runtime-tokio", "postgres", "uuid", "chrono", "json", "migrate", "rust_decimal"] }
-rust_decimal = { version = "1", features = ["serde", "serde-with-str"] }
-clickhouse = { version = "0.15", features = ["time", "chrono"] }
+rust_decimal = { version = "1.43.0", features = ["serde", "serde-with-str"] }
+clickhouse = { version = "0.15.2", features = ["time", "chrono"] }
 
 # Redis
 # `enable-rustls` gives fred its rustls connector, for `rediss://` URLs.
@@ -95,9 +95,9 @@ clickhouse = { version = "0.15", features = ["time", "chrono"] }
 # with the same TLS stack the HTTP client uses (below): rustls on
 # aws-lc-rs, the platform's roots through rustls-platform-verifier. No
 # OpenSSL anywhere, so the static musl image needs nothing new.
-fred = { version = "10", features = ["subscriber-client", "i-scripts", "enable-rustls"] }
-rustls = { version = "0.23", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
-rustls-platform-verifier = "0.7"
+fred = { version = "10.1.0", features = ["subscriber-client", "i-scripts", "enable-rustls"] }
+rustls = { version = "0.23.45", default-features = false, features = ["aws_lc_rs", "std", "tls12"] }
+rustls-platform-verifier = "0.7.1"
 
 # Auth
 # Crypto-critical crates are pinned with `=` so a silent minor-release
@@ -105,51 +105,51 @@ rustls-platform-verifier = "0.7"
 # `cargo update`. Bumps are deliberate and reviewed.
 jsonwebtoken = { version = "=11.1.0", features = ["rust_crypto"] }
 argon2 = "=0.6.0"
-openidconnect = { version = "4", features = ["reqwest"] }
+openidconnect = { version = "4.0.1", features = ["reqwest"] }
 totp-rs = { version = "6", default-features = false, features = ["std", "gen_secret", "otpauth"] }
-data-encoding = "2"
+data-encoding = "2.11.1"
 
 # Serialization
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
+serde = { version = "1.0.229", features = ["derive"] }
+serde_json = "1.0.154"
 
 # HTTP client (upstream proxy)
-reqwest = { version = "0.13", features = ["stream", "json", "rustls"] }
-hyper = { version = "1", features = ["full"] }
-hyper-util = "0.1"
-http-body-util = "0.1"
-bytes = "1"
+reqwest = { version = "0.13.5", features = ["stream", "json", "rustls"] }
+hyper = { version = "1.12.0", features = ["full"] }
+hyper-util = "0.1.21"
+http-body-util = "0.1.5"
+bytes = "1.12.1"
 
 # Async
-futures = "0.3"
-tokio-stream = "0.1"
-async-stream = "0.3"
+futures = "0.3.34"
+tokio-stream = "0.1.19"
+async-stream = "0.3.6"
 
 sha2 = "=0.11.0"
 sha1 = "=0.11.0"
 hmac = "=0.13.0"
 p256 = { version = "=0.14.0", features = ["ecdsa"] }
 ecdsa = { version = "=0.17.0", features = ["algorithm"] }
-rand = "0.10"
-hex = "0.4"
+rand = "0.10.3"
+hex = "0.4.3"
 # Crypto primitives are pinned exactly so a `cargo update` can never swap
 # a verification default underneath the at-rest envelope.
 aes-gcm = "=0.11.1"
 subtle = "=2.6.1"
-url = "2"
+url = "2.5.8"
 
 # Observability
-tracing = "0.1"
-tracing-subscriber = { version = "0.3", features = ["env-filter", "json"] }
-metrics = "0.24"
-metrics-exporter-prometheus = { version = "0.18", default-features = false }
+tracing = "0.1.44"
+tracing-subscriber = { version = "0.3.23", features = ["env-filter", "json"] }
+metrics = "0.24.6"
+metrics-exporter-prometheus = { version = "0.18.3", default-features = false }
 
 # Config
-dotenvy = "0.15"
+dotenvy = "0.15.7"
 
 # API documentation
 utoipa = { version = "6", features = ["axum_extras", "uuid", "chrono"] }
-utoipa-swagger-ui = { version = "10", features = ["axum"] }
+utoipa-swagger-ui = { version = "10.0.1", features = ["axum"] }
 
 # AWS SigV4 for the S3-compatible body store. Bedrock's signing,
 # eventstream unframing and model catalog come from tw-bedrock.
@@ -157,16 +157,16 @@ utoipa-swagger-ui = { version = "10", features = ["axum"] }
 # Credentials from explicit access_key/secret_key values (as opposed to the
 # default credential chain). This does NOT embed credentials in the binary —
 # they are loaded at runtime from encrypted configuration.
-aws-sigv4 = "1"
-aws-credential-types = { version = "1", features = ["hardcoded-credentials"] }
+aws-sigv4 = "1.6.0"
+aws-credential-types = { version = "1.3.0", features = ["hardcoded-credentials"] }
 
 # Utils
-arc-swap = "1"
-xxhash-rust = { version = "0.8", features = ["xxh3"] }
-uuid = { version = "1", features = ["v4", "v5", "serde"] }
-chrono = { version = "0.4", features = ["serde"] }
-thiserror = "2"
-anyhow = "1"
+arc-swap = "1.9.2"
+xxhash-rust = { version = "0.8.19", features = ["xxh3"] }
+uuid = { version = "1.28.0", features = ["v4", "v5", "serde"] }
+chrono = { version = "0.4.45", features = ["serde"] }
+thiserror = "2.0.21"
+anyhow = "1.0.104"
 
 # Workspace crates
 think-watch-common = { path = "crates/common" }
diff --git a/crates/auth/Cargo.toml b/crates/auth/Cargo.toml
index aecd00fb..cb3658bf 100644
--- a/crates/auth/Cargo.toml
+++ b/crates/auth/Cargo.toml
@@ -24,7 +24,7 @@ axum = { workspace = true }
 sqlx = { workspace = true }
 openidconnect = { workspace = true }
 reqwest = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 tokio = { workspace = true }
 totp-rs = { workspace = true }
 data-encoding = { workspace = true }
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
index b196e8bc..1f44cedb 100644
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -46,5 +46,5 @@ url = { workspace = true }
 # against any S3-compatible backend including RustFS / MinIO / AWS S3).
 aws-sigv4 = { workspace = true }
 aws-credential-types = { workspace = true }
-http_1x = { package = "http", version = "1" }
-async-trait = "0.1"
+http_1x = { package = "http", version = "1.5.0" }
+async-trait = "0.1.92"
diff --git a/crates/gateway/Cargo.toml b/crates/gateway/Cargo.toml
index 9d138611..9ac69364 100644
--- a/crates/gateway/Cargo.toml
+++ b/crates/gateway/Cargo.toml
@@ -15,7 +15,7 @@ reqwest = { workspace = true }
 hyper = { workspace = true }
 hyper-util = { workspace = true }
 http-body-util = { workspace = true }
-bytes = "1"
+bytes = "1.12.1"
 axum = { workspace = true }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
@@ -31,7 +31,7 @@ tracing = { workspace = true }
 fred = { workspace = true }
 utoipa = { workspace = true }
 # sha2 removed — cache now uses xxhash; HMAC signing uses hmac crate in server
-regex = "1"
+regex = "1.13.1"
 rand = { workspace = true }
 metrics = { workspace = true }
 xxhash-rust = { workspace = true }
@@ -39,4 +39,4 @@ arc-swap = { workspace = true }
 rust_decimal = { workspace = true }
 
 [dev-dependencies]
-http_1x = { package = "http", version = "1" }
+http_1x = { package = "http", version = "1.5.0" }
diff --git a/crates/mcp-gateway/Cargo.toml b/crates/mcp-gateway/Cargo.toml
index 72a3e458..98202d65 100644
--- a/crates/mcp-gateway/Cargo.toml
+++ b/crates/mcp-gateway/Cargo.toml
@@ -13,7 +13,7 @@ tokio = { workspace = true }
 reqwest = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 uuid = { workspace = true }
 chrono = { workspace = true }
 thiserror = { workspace = true }
diff --git a/crates/server/Cargo.toml b/crates/server/Cargo.toml
index c14e4140..b262f871 100644
--- a/crates/server/Cargo.toml
+++ b/crates/server/Cargo.toml
@@ -47,15 +47,15 @@ p256 = { workspace = true }
 ecdsa = { workspace = true }
 rand = { workspace = true }
 data-encoding = { workspace = true }
-serde_urlencoded = "0.7"
+serde_urlencoded = "0.7.1"
 subtle = { workspace = true }
 url = { workspace = true }
 metrics = { workspace = true }
 metrics-exporter-prometheus = { workspace = true }
-regex = "1"
+regex = "1.13.1"
 arc-swap = { workspace = true }
 clickhouse = { workspace = true }
 
 [dev-dependencies]
-wiremock = "0.6"
+wiremock = "0.6.5"
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
diff --git a/crates/test-support/Cargo.toml b/crates/test-support/Cargo.toml
index 3d0b1601..8c7a2046 100644
--- a/crates/test-support/Cargo.toml
+++ b/crates/test-support/Cargo.toml
@@ -20,7 +20,7 @@ think-watch-auth = { workspace = true }
 think-watch-gateway = { workspace = true }
 think-watch-mcp-gateway = { workspace = true }
 
-async-trait = "0.1"
+async-trait = "0.1.92"
 axum = { workspace = true }
 tokio = { workspace = true }
 tower = { workspace = true }
@@ -45,8 +45,8 @@ ecdsa = { workspace = true }
 rand = { workspace = true }
 url = { workspace = true }
 clickhouse = { workspace = true }
-once_cell = "1"
-wiremock = "0.6"
+once_cell = "1.21.4"
+wiremock = "0.6.5"
 tokio-tungstenite = "0.30"
 futures = { workspace = true }
 async-stream = { workspace = true }