diff --git a/Cargo.lock b/Cargo.lock
index a111384..f311cac 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4951,9 +4951,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.63.3"
+version = "0.64.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "036204edbd199552a5b3832f63c60dcdf395dc44c7f06b4af1c0e8139cc11bce"
+checksum = "ba61e87b9ec9a39a59a6bbed4c0b8ff7fb07073405b24a767a1f2c8560ac8f58"
 dependencies = [
  "aes 0.9.1",
  "bitflags 2.13.0",
diff --git a/Cargo.toml b/Cargo.toml
index 419b86a..a66ed68 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -305,7 +305,7 @@ rand.workspace = true
 ratatui = { version = "0.30", optional = true }
 # exclude rsa to avoid https://rustsec.org/advisories/RUSTSEC-2023-0071. ring, not aws-lc-rs, is the
 # crypto backend, so aws-lc stays out of the dependency graph even with `ssh` on (deny.toml bans it).
-russh = { version = "0.63.2", optional = true, default-features = false, features = ["flate2", "ring"] }
+russh = { version = "0.64.1", optional = true, default-features = false, features = ["flate2", "ring"] }
 secrecy.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index ae4792d..35a9cfd 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -1610,7 +1610,7 @@ version = "0.2.11"
 criteria = "safe-to-deploy"
 
 [[exemptions.russh]]
-version = "0.63.3"
+version = "0.64.1"
 criteria = "safe-to-deploy"
 
 [[exemptions.russh-cryptovec]]