diff --git a/runtime/audit/Cargo.toml b/runtime/audit/Cargo.toml
index 92d90fd2..995acb79 100644
--- a/runtime/audit/Cargo.toml
+++ b/runtime/audit/Cargo.toml
@@ -23,7 +23,7 @@ uuid = { workspace = true }
 chrono = { workspace = true }
 sqlx = { workspace = true }
 sha2 = { workspace = true }
-hmac = "0.12"
+hmac = "0.13"
 hex = "0.4"
 # Ed25519 audit signing: third parties verify with the public key alone.
 ed25519-dalek = "2"