diff --git a/Cargo.lock b/Cargo.lock
index f740d93c..9242495b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2245,16 +2245,17 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.3.1"
+version = "10.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
 dependencies = [
  "base64 0.22.1",
+ "getrandom 0.2.17",
  "js-sys",
  "pem",
- "ring",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
 ]
 
@@ -3147,7 +3148,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha",
- "rand_core",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -3157,7 +3158,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.6.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
+dependencies = [
+ "getrandom 0.2.17",
 ]
 
 [[package]]
@@ -3686,6 +3696,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
diff --git a/Cargo.toml b/Cargo.toml
index c7f614f1..4f4d02f6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -46,7 +46,7 @@ rusqlite = { version = "0.37", features = ["bundled"] }
 tree-sitter = "0.25"
 tempfile = "3"
 deadpool-sqlite = "0.12"
-jsonwebtoken = "9"
+jsonwebtoken = "10"
 # rustls-tls instead of the default native-tls (openssl) backend so binaries
 # link no system TLS library — required for static musl builds and simple
 # Windows cross-compilation. Crates needing streaming add `features = ["stream"]`.
diff --git a/crates/codetours-server/Cargo.toml b/crates/codetours-server/Cargo.toml
index 7947556d..b4389a93 100644
--- a/crates/codetours-server/Cargo.toml
+++ b/crates/codetours-server/Cargo.toml
@@ -34,7 +34,7 @@ rusqlite = { workspace = true }
 deadpool-sqlite = { workspace = true }
 futures-util = "0.3"
 zstd = "0.13"
-jsonwebtoken = "9"
+jsonwebtoken = "10"
 reqwest = { workspace = true }
 urlencoding = "2"
 dotenvy = "0.15.7"