diff --git a/Cargo.lock b/Cargo.lock
index 9ef365835..6e0ae36cb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -122,7 +122,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -133,7 +133,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1162,7 +1162,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1239,7 +1239,7 @@ dependencies = [
  "prost-types 0.14.4",
  "protoc-bin-vendored",
  "quickcheck",
- "rand 0.9.4",
+ "rand 0.8.8",
  "rand_chacha 0.9.0",
  "rocksdb",
  "rstest",
@@ -1284,7 +1284,7 @@ name = "dsm-sphincs"
 version = "0.1.0"
 dependencies = [
  "blake3",
- "rand 0.9.4",
+ "rand 0.8.8",
  "rand_chacha 0.9.0",
  "subtle",
  "zeroize",
@@ -1345,7 +1345,7 @@ dependencies = [
  "prost-types 0.14.4",
  "protoc-bin-vendored",
  "quickcheck",
- "rand 0.9.4",
+ "rand 0.8.8",
  "rand_chacha 0.9.0",
  "rcgen",
  "reqwest",
@@ -1396,7 +1396,7 @@ dependencies = [
  "ml-kem",
  "once_cell",
  "prost 0.14.4",
- "rand 0.8.6",
+ "rand 0.8.8",
  "reqwest",
  "rusqlite",
  "rustls",
@@ -1448,7 +1448,7 @@ dependencies = [
  "dsm",
  "instant",
  "prost 0.14.4",
- "rand 0.9.4",
+ "rand 0.8.8",
  "rand_chacha 0.9.0",
  "regex",
  "reqwest",
@@ -1600,7 +1600,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2791,7 +2791,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3550,9 +3550,9 @@ checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
 [[package]]
 name = "rand"
-version = "0.8.6"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ca0ecfa931c29007047d1bc58e623ab12e5590e8c7cc53200d5202b69266d8a"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
@@ -3895,7 +3895,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4279,7 +4279,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3a766e1110788c36f4fa1c2b71b387a7815aa65f88ce0229841826633d93723e"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -4389,7 +4389,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5178,7 +5178,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/crates/dsm-sphincs/Cargo.toml b/crates/dsm-sphincs/Cargo.toml
index 85796d421..014cbdcc0 100644
--- a/crates/dsm-sphincs/Cargo.toml
+++ b/crates/dsm-sphincs/Cargo.toml
@@ -14,5 +14,5 @@ blake3 = { version = "1", default-features = false }
 subtle = { version = "2", default-features = false }
 zeroize = { version = "1", default-features = false, features = ["derive", "alloc"] }
 # Deterministic keygen expands the 32-byte seed via ChaCha20 (no_std, no OS RNG).
-rand = { version = "0.9", default-features = false }
+rand = { version = "0.8", default-features = false }
 rand_chacha = { version = "0.9", default-features = false }
diff --git a/dsm_client/deterministic_state_machine/dsm/Cargo.toml b/dsm_client/deterministic_state_machine/dsm/Cargo.toml
index 9bb0873b1..f7c075b64 100644
--- a/dsm_client/deterministic_state_machine/dsm/Cargo.toml
+++ b/dsm_client/deterministic_state_machine/dsm/Cargo.toml
@@ -135,7 +135,7 @@ bitflags = "2.13.0"
 arrayref = "0.3.9"
 argon2 = "0.5.3"
 
-rand = "0.9.2"
+rand = "0.8.8"
 uuid = { version = "1.23", features = ["std"] }
 # serde_cbor removed from code paths (unmaintained); deterministic CBOR is hand-encoded locally
 # Prefer stable crypto crates to reduce duplicate dependency versions across workspace.
diff --git a/dsm_client/deterministic_state_machine/dsm_sdk/Cargo.toml b/dsm_client/deterministic_state_machine/dsm_sdk/Cargo.toml
index 925ec8008..286d4ad18 100644
--- a/dsm_client/deterministic_state_machine/dsm_sdk/Cargo.toml
+++ b/dsm_client/deterministic_state_machine/dsm_sdk/Cargo.toml
@@ -114,7 +114,7 @@ ed25519-dalek = { version = "2", default-features = false, features = ["std"] }
 # AEAD
 chacha20poly1305 = { version = "0.10", default-features = false, features = ["alloc", "std"] }
 hmac = "0.13.0"
-rand = "0.9.2"
+rand = "0.8.8"
 rand_chacha = "0.9.0"
 getrandom = "0.4.2"
 merlin = "3.0.0"
diff --git a/tools/vertical_validation/Cargo.toml b/tools/vertical_validation/Cargo.toml
index 96d6b3583..7ce86d5de 100644
--- a/tools/vertical_validation/Cargo.toml
+++ b/tools/vertical_validation/Cargo.toml
@@ -43,7 +43,7 @@ instant = "0.1"
 dsm = { version = "0.1.0-beta.3", path = "../../dsm_client/deterministic_state_machine/dsm" }
 
 # Deterministic seeded RNG for reproducible property tests
-rand = "0.9.2"
+rand = "0.8.8"
 rand_chacha = "0.9.0"
 
 [lints]