diff --git a/Cargo.lock b/Cargo.lock
index c0073927b3..61afb1bd71 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -53,7 +53,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "generic-array",
 ]
 
@@ -138,7 +138,7 @@ dependencies = [
  "cc",
  "cesu8",
  "jni 0.21.1",
- "jni-sys",
+ "jni-sys 0.3.0",
  "libc",
  "log",
  "ndk",
@@ -205,7 +205,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -216,7 +216,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.61.2",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -802,15 +802,6 @@ dependencies = [
  "num-traits",
 ]
 
-[[package]]
-name = "bincode"
-version = "1.3.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "bip39"
 version = "2.2.2"
@@ -943,7 +934,7 @@ version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -961,6 +952,15 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "block-buffer"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2f6c7dbe95a6ed67ad9f18e57daf93a2f034c524b99fd2b76d18fdfeb6660aa"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "block2"
 version = "0.5.1"
@@ -1331,9 +1331,9 @@ dependencies = [
 
 [[package]]
 name = "chacha20"
-version = "0.10.0"
+version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.3.0",
@@ -1597,7 +1597,7 @@ version = "0.4.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "inout",
  "zeroize",
 ]
@@ -1681,6 +1681,12 @@ dependencies = [
  "x11rb",
 ]
 
+[[package]]
+name = "cmov"
+version = "0.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c9ea0ac24bc397ab3c98583a3c9ba74fa56b09a4449bbe172b9b1ddb016027a"
+
 [[package]]
 name = "codespan-reporting"
 version = "0.11.1"
@@ -1859,6 +1865,12 @@ dependencies = [
  "tracing-subscriber",
 ]
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "const_format"
 version = "0.2.35"
@@ -2051,6 +2063,12 @@ dependencies = [
  "itertools 0.10.5",
 ]
 
+[[package]]
+name = "critical-section"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "790eea4361631c5e7d22598ecd5723ff611904e3344ce8720784c93e3d83d40b"
+
 [[package]]
 name = "crossbeam"
 version = "0.8.4"
@@ -2149,7 +2167,7 @@ dependencies = [
  "chacha20poly1305",
  "generic-array",
  "hex",
- "hmac",
+ "hmac 0.12.1",
  "lazy_static",
  "merlin",
  "num",
@@ -2167,7 +2185,7 @@ dependencies = [
  "serde",
  "serialization",
  "sha-1",
- "sha2",
+ "sha2 0.10.9",
  "sha3",
  "strum 0.26.3",
  "test-utils",
@@ -2187,6 +2205,15 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "crypto-common"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
+dependencies = [
+ "hybrid-array",
+]
+
 [[package]]
 name = "csv"
 version = "1.4.0"
@@ -2240,6 +2267,15 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "ctutils"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d5515a3834141de9eafb9717ad39eea8247b5674e6066c404e8c4b365d2a29e"
+dependencies = [
+ "cmov",
+]
+
 [[package]]
 name = "cursor-icon"
 version = "1.2.0"
@@ -2255,7 +2291,7 @@ dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
- "digest",
+ "digest 0.10.7",
  "fiat-crypto",
  "rustc_version",
  "subtle",
@@ -2505,11 +2541,23 @@ version = "0.10.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
- "block-buffer",
- "crypto-common",
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
+[[package]]
+name = "digest"
+version = "0.11.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
+dependencies = [
+ "block-buffer 0.12.1",
+ "const-oid",
+ "crypto-common 0.2.2",
+ "ctutils",
+]
+
 [[package]]
 name = "directories"
 version = "5.0.1"
@@ -2636,7 +2684,7 @@ dependencies = [
  "ctor",
  "directories",
  "futures",
- "hickory-client",
+ "hickory-proto",
  "hickory-server",
  "itertools 0.14.0",
  "logging",
@@ -2798,24 +2846,6 @@ version = "1.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "66b7e2430c6dff6a955451e2cfc438f09cea1965a9d6f87f7e3b90decc014099"
 
-[[package]]
-name = "endian-type"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c34f04666d835ff5d62e058c3995147c06f42fe86ff053337632bca83e42702d"
-
-[[package]]
-name = "enum-as-inner"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"
-dependencies = [
- "heck 0.5.0",
- "proc-macro2",
- "quote",
- "syn 2.0.114",
-]
-
 [[package]]
 name = "enum-iterator"
 version = "2.3.0"
@@ -2870,7 +2900,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3306,7 +3336,7 @@ dependencies = [
  "libc",
  "log",
  "rustversion",
- "windows-link 0.2.1",
+ "windows-link 0.1.3",
  "windows-result 0.4.1",
 ]
 
@@ -3330,17 +3360,6 @@ dependencies = [
  "windows-link 0.2.1",
 ]
 
-[[package]]
-name = "getrandom"
-version = "0.1.16"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc3cb4d91f53b50155bdcfd23f6a4c39ae1969c2ae85982b135750cccaf5fce"
-dependencies = [
- "cfg-if",
- "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -3593,6 +3612,11 @@ name = "hashbrown"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash 0.2.0",
+]
 
 [[package]]
 name = "hashbrown"
@@ -3704,62 +3728,66 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfa686283ad6dd069f105e5ab091b04c62850d3e4cf5d67debad1933f55023df"
 
 [[package]]
-name = "hickory-client"
-version = "0.24.4"
+name = "hickory-net"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "156579a5cd8d1fc6f0df87cc21b6ee870db978a163a1ba484acd98a4eff5a6de"
+checksum = "c480823ed7c2c5d0f09c41020cb6b7c28029ce60ec42dc942158dcf22f8e0a4d"
 dependencies = [
+ "async-trait",
  "cfg-if",
  "data-encoding",
  "futures-channel",
+ "futures-io",
  "futures-util",
  "hickory-proto",
- "once_cell",
- "radix_trie",
- "rand 0.8.6",
- "thiserror 1.0.69",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "rand 0.10.1",
+ "thiserror 2.0.18",
+ "tinyvec",
  "tokio",
  "tracing",
+ "url",
 ]
 
 [[package]]
 name = "hickory-proto"
-version = "0.24.4"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92652067c9ce6f66ce53cc38d1169daa36e6e7eb7dd3b63b5103bd9d97117248"
+checksum = "12b92608f679a6fa515dd1d15c1ff89443026e391200a2c840c7afcba482893d"
 dependencies = [
- "async-trait",
- "cfg-if",
  "data-encoding",
- "enum-as-inner",
- "futures-channel",
- "futures-io",
- "futures-util",
  "idna",
  "ipnet",
+ "jni 0.22.4",
  "once_cell",
- "rand 0.8.6",
- "thiserror 1.0.69",
+ "rand 0.10.1",
+ "ring",
+ "serde",
+ "thiserror 2.0.18",
  "tinyvec",
- "tokio",
  "tracing",
  "url",
 ]
 
 [[package]]
 name = "hickory-server"
-version = "0.24.4"
+version = "0.26.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "090078aff4e305853f8ccfbc89e6a1eec8a189bcb842be46255a2b660dae9416"
+checksum = "950c2ad9ba2ad35d6890b725baff91305f65b87d7719a6c6071514dc70f13eeb"
 dependencies = [
  "async-trait",
  "bytes",
  "cfg-if",
- "enum-as-inner",
+ "data-encoding",
  "futures-util",
+ "hickory-net",
  "hickory-proto",
+ "ipnet",
+ "prefix-trie",
  "serde",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "time",
  "tokio",
  "tokio-util",
@@ -3785,7 +3813,16 @@ version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
 dependencies = [
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "hmac"
+version = "0.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
+dependencies = [
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -3839,6 +3876,15 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "135b12329e5e3ce057a9f972339ea52bc954fe1e9358ef27f95e89716fbc5424"
 
+[[package]]
+name = "hybrid-array"
+version = "0.4.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3944cf8cf766b40e2a1a333ee5e9b563f854d5fa49d6a8ca2764e97c6eddb214"
+dependencies = [
+ "typenum",
+]
+
 [[package]]
 name = "hyper"
 version = "1.8.1"
@@ -4033,8 +4079,7 @@ dependencies = [
 [[package]]
 name = "iced_glyphon"
 version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41c3bb56f1820ca252bc1d0994ece33d233a55657c0c263ea7cb16895adbde82"
+source = "git+https://github.com/mintlayer/iced-glyphon?rev=acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1#acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1"
 dependencies = [
  "cosmic-text",
  "etagere",
@@ -4343,6 +4388,9 @@ name = "ipnet"
 version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "469fb0b9cefa57e3ef31275ee7cacb78f2fdca44e4765491884a2b119d4eb130"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "iri-string"
@@ -4362,7 +4410,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -4412,7 +4460,7 @@ checksum = "c6df18c2e3db7e453d3c6ac5b3e9d5182664d28788126d39b91f2d1e22b017ec"
 dependencies = [
  "cesu8",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.0",
  "log",
  "thiserror 1.0.69",
  "walkdir",
@@ -4427,19 +4475,68 @@ dependencies = [
  "cesu8",
  "cfg-if",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.0",
  "log",
  "thiserror 1.0.69",
  "walkdir",
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link 0.2.1",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "simd_cesu8",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "jni-sys"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "jni-utils"
 version = "0.1.1"
@@ -4908,9 +5005,12 @@ dependencies = [
 
 [[package]]
 name = "lru"
-version = "0.12.5"
+version = "0.16.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "234cf4f4a04dc1f57e24b96cc0cd600cf2af460d4161ac5ecdd0af8e1f3b2a38"
+checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+dependencies = [
+ "hashbrown 0.16.1",
+]
 
 [[package]]
 name = "lyon"
@@ -4996,12 +5096,12 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "md-5"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d89e7ee0cfbedfc4da3340218492196241d89eefb6dab27de5df917a6d2e78cf"
+checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
  "cfg-if",
- "digest",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -5340,7 +5440,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
 dependencies = [
  "bitflags 2.10.0",
- "jni-sys",
+ "jni-sys 0.3.0",
  "log",
  "ndk-sys 0.6.0+11769913",
  "num_enum",
@@ -5360,7 +5460,7 @@ version = "0.5.0+25.2.9519653"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8c196769dd60fd4f363e11d948139556a344e79d451aeb2fa2fd040738ef7691"
 dependencies = [
- "jni-sys",
+ "jni-sys 0.3.0",
 ]
 
 [[package]]
@@ -5369,7 +5469,7 @@ version = "0.6.0+11769913"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
 dependencies = [
- "jni-sys",
+ "jni-sys 0.3.0",
 ]
 
 [[package]]
@@ -5397,15 +5497,6 @@ dependencies = [
  "utils",
 ]
 
-[[package]]
-name = "nibble_vec"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77a5d83df9f36fe23f0c3648c6bbb8b0298bb5f1939c8f2704431371f4b84d43"
-dependencies = [
- "smallvec",
-]
-
 [[package]]
 name = "nix"
 version = "0.29.0"
@@ -5591,7 +5682,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -6044,6 +6135,10 @@ name = "once_cell"
 version = "1.21.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+dependencies = [
+ "critical-section",
+ "portable-atomic",
+]
 
 [[package]]
 name = "once_cell_polyfill"
@@ -6246,7 +6341,7 @@ dependencies = [
  "rstest_reuse",
  "serde",
  "serialization",
- "siphasher 1.0.2",
+ "siphasher",
  "storage",
  "storage-inmemory",
  "strum 0.26.3",
@@ -6490,7 +6585,7 @@ version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67eabc2ef2a60eb7faa00097bd1ffdb5bd28e62bf39990626a582201b7a754e5"
 dependencies = [
- "siphasher 1.0.2",
+ "siphasher",
 ]
 
 [[package]]
@@ -6499,7 +6594,7 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
 dependencies = [
- "siphasher 1.0.2",
+ "siphasher",
 ]
 
 [[package]]
@@ -6635,6 +6730,12 @@ dependencies = [
  "universal-hash",
 ]
 
+[[package]]
+name = "portable-atomic"
+version = "1.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "05c8b63e8d9609db387f0324918f81d68fe27748f084ef092fb35954d0539a85"
+
 [[package]]
 name = "pos-accounting"
 version = "1.4.0"
@@ -6655,27 +6756,27 @@ dependencies = [
 
 [[package]]
 name = "postgres-protocol"
-version = "0.6.10"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ee9dd5fe15055d2b6806f4736aa0c9637217074e224bbec46d4041b91bb9491"
+checksum = "08808e3c483c46e999108051c78334f473d5adb59d78bb80a1268c7e6aa6c514"
 dependencies = [
  "base64 0.22.1",
  "byteorder",
  "bytes",
  "fallible-iterator 0.2.0",
- "hmac",
+ "hmac 0.13.0",
  "md-5",
  "memchr",
- "rand 0.9.4",
- "sha2",
+ "rand 0.10.1",
+ "sha2 0.11.0",
  "stringprep",
 ]
 
 [[package]]
 name = "postgres-types"
-version = "0.2.12"
+version = "0.2.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "54b858f82211e84682fecd373f68e1ceae642d8d751a1ebd13f33de6257b3e20"
+checksum = "851ca9db4932932d69f3ea811b1abe63087a0f740a47692619dd40d4899b68be"
 dependencies = [
  "bytes",
  "fallible-iterator 0.2.0",
@@ -6733,6 +6834,17 @@ dependencies = [
  "termtree",
 ]
 
+[[package]]
+name = "prefix-trie"
+version = "0.8.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cf6e3177f0684016a5c209b00882e15f8bdd3f3bb48f0491df10cd102d0c6e7"
+dependencies = [
+ "either",
+ "ipnet",
+ "num-traits",
+]
+
 [[package]]
 name = "presser"
 version = "0.3.1"
@@ -6763,19 +6875,6 @@ dependencies = [
  "unicode-width",
 ]
 
-[[package]]
-name = "probabilistic-collections"
-version = "0.7.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "10e885f79599b2c3fe1ad8ab539b4dbb0c6b801b5948696a6b0b6dee18675cea"
-dependencies = [
- "bincode",
- "byteorder",
- "rand 0.7.3",
- "rand_xorshift 0.2.0",
- "siphasher 0.3.11",
-]
-
 [[package]]
 name = "proc-macro-crate"
 version = "3.4.0"
@@ -6825,7 +6924,7 @@ dependencies = [
  "num-traits",
  "rand 0.9.4",
  "rand_chacha 0.9.0",
- "rand_xorshift 0.4.0",
+ "rand_xorshift",
  "regex-syntax",
  "rusty-fork",
  "tempfile",
@@ -6961,29 +7060,6 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dc33ff2d4973d518d823d61aa239014831e521c75da58e3df4840d3f47749d09"
 
-[[package]]
-name = "radix_trie"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c069c179fcdc6a2fe24d8d18305cf085fdbd4f922c041943e203685d6a1c58fd"
-dependencies = [
- "endian-type",
- "nibble_vec",
-]
-
-[[package]]
-name = "rand"
-version = "0.7.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
-dependencies = [
- "getrandom 0.1.16",
- "libc",
- "rand_chacha 0.2.2",
- "rand_core 0.5.1",
- "rand_hc",
-]
-
 [[package]]
 name = "rand"
 version = "0.8.6"
@@ -7011,21 +7087,11 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
- "chacha20 0.10.0",
+ "chacha20 0.10.2",
  "getrandom 0.4.1",
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_chacha"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
-dependencies = [
- "ppv-lite86",
- "rand_core 0.5.1",
-]
-
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -7056,15 +7122,6 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
-[[package]]
-name = "rand_core"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
-dependencies = [
- "getrandom 0.1.16",
-]
-
 [[package]]
 name = "rand_core"
 version = "0.6.4"
@@ -7089,24 +7146,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
-[[package]]
-name = "rand_hc"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
-dependencies = [
- "rand_core 0.5.1",
-]
-
-[[package]]
-name = "rand_xorshift"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77d416b86801d23dde1aa643023b775c3a462efc0ed96443add11546cdf1dca8"
-dependencies = [
- "rand_core 0.5.1",
-]
-
 [[package]]
 name = "rand_xorshift"
 version = "0.4.0"
@@ -7396,7 +7435,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
 dependencies = [
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -7650,14 +7689,14 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.11.0",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.36"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c665f33d38cea657d9614f766881e4d510e0eda4239891eea56b4cadcf01801b"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "log",
  "once_cell",
@@ -7718,9 +7757,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -7824,7 +7863,7 @@ dependencies = [
  "merlin",
  "rand_core 0.6.4",
  "serde_bytes",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
@@ -8199,7 +8238,7 @@ checksum = "f5058ada175748e33390e40e872bd0fe59a19f265d0158daa551c5a88a76009c"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -8210,7 +8249,7 @@ checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest",
+ "digest 0.10.7",
 ]
 
 [[package]]
@@ -8221,7 +8260,18 @@ checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
  "cpufeatures 0.2.17",
- "digest",
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -8230,7 +8280,7 @@ version = "0.10.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "75872d278a8f37ef87fa0ddbda7802605cb18344497949862c0d4dcb291eba60"
 dependencies = [
- "digest",
+ "digest 0.10.7",
  "keccak",
 ]
 
@@ -8287,16 +8337,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
 [[package]]
-name = "simdutf8"
-version = "0.1.5"
+name = "simd_cesu8"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+checksum = "11031e251abf8611c80f460e19dbdeb54a66db918e49c65a7065b46ac7aec520"
+dependencies = [
+ "rustc_version",
+ "simdutf8",
+]
 
 [[package]]
-name = "siphasher"
-version = "0.3.11"
+name = "simdutf8"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38b58827f4464d87d377d175e90bf58eb00fd8716ff0a62f80356b5e61555d0d"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
 
 [[package]]
 name = "siphasher"
@@ -8428,7 +8482,7 @@ dependencies = [
  "curve25519-dalek",
  "rand_core 0.6.4",
  "rustc_version",
- "sha2",
+ "sha2 0.10.9",
  "subtle",
 ]
 
@@ -8843,7 +8897,7 @@ dependencies = [
  "getrandom 0.4.1",
  "once_cell",
  "rustix 1.1.3",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -9136,9 +9190,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-postgres"
-version = "0.7.16"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dcea47c8f71744367793f16c2db1f11cb859d28f436bdb4ca9193eb1f787ee42"
+checksum = "a528f7d280f6d5b9cd149635c8705b0dd049754bc67d81d31fa25169a93809d3"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -9153,7 +9207,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.4",
+ "rand 0.10.1",
  "socket2 0.6.2",
  "tokio",
  "tokio-util",
@@ -9678,7 +9732,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc1de2c688dc15305988b563c3854064043356019f97a4b46276fe734c4f07ea"
 dependencies = [
- "crypto-common",
+ "crypto-common 0.1.7",
  "subtle",
 ]
 
@@ -9749,13 +9803,13 @@ dependencies = [
  "loom",
  "num-traits",
  "parity-scale-codec",
- "probabilistic-collections",
  "qrcodegen",
  "randomness",
  "regex",
  "rstest",
  "serial_test",
  "serialization",
+ "siphasher",
  "slave-pool",
  "static_assertions",
  "tempfile",
@@ -10266,12 +10320,6 @@ dependencies = [
  "try-lock",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.11.1+wasi-snapshot-preview1"
@@ -10645,7 +10693,7 @@ dependencies = [
  "js-sys",
  "log",
  "naga",
- "parking_lot 0.12.5",
+ "parking_lot 0.11.2",
  "profiling",
  "raw-window-handle",
  "smallvec",
@@ -10673,7 +10721,7 @@ dependencies = [
  "log",
  "naga",
  "once_cell",
- "parking_lot 0.12.5",
+ "parking_lot 0.11.2",
  "profiling",
  "raw-window-handle",
  "rustc-hash 1.1.0",
@@ -10715,7 +10763,7 @@ dependencies = [
  "ndk-sys 0.5.0+25.2.9519653",
  "objc",
  "once_cell",
- "parking_lot 0.12.5",
+ "parking_lot 0.11.2",
  "profiling",
  "range-alloc",
  "raw-window-handle",
@@ -10779,7 +10827,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 8dd68902a7..db8c5fa950 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -187,8 +187,8 @@ hashbrown = "0.17"
 heck = "0.5"
 hex = "0.4"
 hex-literal = "0.4"
-hickory-client = "0.24"
-hickory-server = "0.24"
+hickory-proto = "0.26"
+hickory-server = "0.26"
 hmac = "0.12"
 http = "1.3"
 hyper = "1.7"
@@ -215,7 +215,6 @@ oneshot = "0.1"
 parity-scale-codec = "3.7"
 parking_lot = "0.12"
 paste = "1.0"
-probabilistic-collections = "0.7"
 proc-macro2 = "1.0"
 proptest = "1.11"
 qrcodegen = "1.8"
@@ -365,3 +364,8 @@ ledger-proto = { git = "https://github.com/ledger-community/rust-ledger.git", re
 # Note that the fix is needed for the Ledger app, but we have to use the same version of parity-scale-codec
 # across Trezor, Ledger, mintlayer-core and mintlayer-core-primitives repos.
 parity-scale-codec = { git = "https://github.com/paritytech/parity-scale-codec.git", rev = "5021525697edc0661591ebc71392c48d950a10b0" }
+# Fork of iced_glyphon 0.6.0 with the lru dependency upgraded to 0.16.3 to pick up the fix
+# for RUSTSEC-2026-0002 ("IterMut violates Stacked Borrows by invalidating internal pointer").
+# Upstream has replaced the crate with "cryoglyph" in unreleased iced 0.15, so there is no
+# upstream release with the fix. Drop this patch once iced ships one.
+iced_glyphon = { git = "https://github.com/mintlayer/iced-glyphon", rev = "acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1" }
diff --git a/dns-server/Cargo.toml b/dns-server/Cargo.toml
index 1fd38803bb..83d08bcc2e 100644
--- a/dns-server/Cargo.toml
+++ b/dns-server/Cargo.toml
@@ -28,7 +28,7 @@ itertools.workspace = true
 parity-scale-codec.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, default-features = false }
-hickory-client.workspace = true
+hickory-proto.workspace = true
 hickory-server.workspace = true
 
 [dev-dependencies]
diff --git a/dns-server/src/config.rs b/dns-server/src/config.rs
index 7d06fc60d6..9617f27a37 100644
--- a/dns-server/src/config.rs
+++ b/dns-server/src/config.rs
@@ -19,7 +19,7 @@ use std::{
 };
 
 use clap::Parser;
-use hickory_client::rr::Name;
+use hickory_proto::rr::Name;
 
 use common::primitives::per_thousand::PerThousand;
 use utils::{app_version_with_git_info, clap_utils, root_user::ForceRunAsRootOptions};
diff --git a/dns-server/src/dns_server/mod.rs b/dns-server/src/dns_server/mod.rs
index bf1e4a916c..c214e30930 100644
--- a/dns-server/src/dns_server/mod.rs
+++ b/dns-server/src/dns_server/mod.rs
@@ -22,21 +22,16 @@ use std::{
 };
 
 use futures::never::Never;
-use hickory_client::{
-    proto::rr::{LowerName, RrKey},
-    rr::{
-        Name, RData, RecordSet, RecordType,
-        rdata::{NS, SOA},
-    },
+use hickory_proto::rr::{
+    LowerName, Name, RData, RecordSet, RecordType, RrKey, TSigResponseContext,
+    rdata::{NS, SOA},
 };
 use hickory_server::{
-    ServerFuture,
-    authority::{
-        AuthLookup, Authority, Catalog, LookupError, LookupOptions, MessageRequest, UpdateResult,
-        ZoneType,
+    server::{Request, RequestInfo, Server},
+    store::in_memory::InMemoryZoneHandler,
+    zone_handler::{
+        AuthLookup, AxfrPolicy, Catalog, LookupControlFlow, LookupOptions, ZoneHandler, ZoneType,
     },
-    server::RequestInfo,
-    store::in_memory::InMemoryAuthority,
 };
 use itertools::Itertools;
 use tokio::{net::UdpSocket, sync::mpsc};
@@ -61,7 +56,7 @@ pub enum DnsServerCommand {
 pub struct DnsServer {
     auth: Arc<AuthorityImpl>,
 
-    server: ServerFuture<Catalog>,
+    server: Server<Catalog>,
 
     cmd_rx: mpsc::UnboundedReceiver<DnsServerCommand>,
 }
@@ -91,7 +86,8 @@ impl DnsServer {
         chain_config: Arc<ChainConfig>,
         cmd_rx: mpsc::UnboundedReceiver<DnsServerCommand>,
     ) -> crate::Result<Self> {
-        let inner = InMemoryAuthority::empty(config.host.clone(), ZoneType::Primary, false);
+        let inner =
+            InMemoryZoneHandler::empty(config.host.clone(), ZoneType::Primary, AxfrPolicy::Deny);
 
         let auth = Arc::new(AuthorityImpl {
             config: AuthorityImplConfig::from_dns_server_config(&config),
@@ -102,11 +98,13 @@ impl DnsServer {
             ipv6_addrs: Default::default(),
         });
 
+        let handlers: Vec<Arc<dyn ZoneHandler>> = vec![Arc::clone(&auth) as _];
+
         let mut catalog = Catalog::new();
 
-        catalog.upsert(config.host.clone().into(), Box::new(Arc::clone(&auth)));
+        catalog.upsert(config.host.clone().into(), handlers);
 
-        let mut server = ServerFuture::new(catalog);
+        let mut server = Server::new(catalog);
 
         for bind_addr in config.bind_addr.iter() {
             let udp_socket = UdpSocket::bind(bind_addr).await?;
@@ -139,7 +137,7 @@ impl DnsServer {
         server.block_until_done().await?;
 
         Err(DnsServerError::Other(
-            "trust_dns_server terminated unexpectedly",
+            "hickory DNS server terminated unexpectedly",
         ))
     }
 }
@@ -171,12 +169,12 @@ impl AuthorityImplConfig {
     }
 }
 
-/// Wrapper for InMemoryAuthority that selects random addresses every second
+/// Wrapper for InMemoryZoneHandler that selects random addresses every second
 struct AuthorityImpl {
     chain_config: Arc<ChainConfig>,
     config: AuthorityImplConfig,
     serial: RelaxedAtomicU32,
-    inner: InMemoryAuthority,
+    inner: InMemoryZoneHandler,
     ipv4_addrs: Mutex<BTreeMap<Ipv4Addr, SoftwareInfo>>,
     ipv6_addrs: Mutex<BTreeMap<Ipv6Addr, SoftwareInfo>>,
 }
@@ -355,20 +353,19 @@ impl AuthorityImpl {
     }
 }
 
+/// Note: dynamic DNS updates (RFC 2136) are not supported. The `ZoneHandler::update`
+/// default implementation responds with `NotImplemented`, which is a stricter rejection
+/// than the previous hickory 0.24-based code (which delegated to `InMemoryAuthority`'s
+/// RFC 2136 processing and only rejected updates indirectly, for the lack of any
+/// configured signature keys). A public seed node must never accept updates.
 #[async_trait::async_trait]
-impl Authority for AuthorityImpl {
-    type Lookup = AuthLookup;
-
+impl ZoneHandler for AuthorityImpl {
     fn zone_type(&self) -> ZoneType {
         self.inner.zone_type()
     }
 
-    fn is_axfr_allowed(&self) -> bool {
-        self.inner.is_axfr_allowed()
-    }
-
-    async fn update(&self, update: &MessageRequest) -> UpdateResult<bool> {
-        self.inner.update(update).await
+    fn axfr_policy(&self) -> AxfrPolicy {
+        self.inner.axfr_policy()
     }
 
     fn origin(&self) -> &LowerName {
@@ -379,8 +376,9 @@ impl Authority for AuthorityImpl {
         &self,
         name: &LowerName,
         query_type: RecordType,
+        request_info: Option<&RequestInfo<'_>>,
         lookup_options: LookupOptions,
-    ) -> Result<Self::Lookup, LookupError> {
+    ) -> LookupControlFlow<AuthLookup> {
         log::trace!(
             "In lookup for {:?}, query_type = {:?}, lookup_options = {:?}",
             name,
@@ -388,32 +386,32 @@ impl Authority for AuthorityImpl {
             lookup_options
         );
         self.refresh().await;
-        self.inner.lookup(name, query_type, lookup_options).await
+        self.inner.lookup(name, query_type, request_info, lookup_options).await
     }
 
     async fn search(
         &self,
-        request_info: RequestInfo<'_>,
+        request: &Request,
         lookup_options: LookupOptions,
-    ) -> Result<Self::Lookup, LookupError> {
+    ) -> (LookupControlFlow<AuthLookup>, Option<TSigResponseContext>) {
         log::trace!(
             "In search, src = {:?}, protocol = {:?}, header = {:?}, query = {:?}, lookup_options = {:?}",
-            request_info.src,
-            request_info.protocol,
-            request_info.header,
-            request_info.query,
+            request.src(),
+            request.protocol(),
+            request.metadata,
+            request.queries,
             lookup_options
         );
         self.refresh().await;
-        self.inner.search(request_info, lookup_options).await
+        self.inner.search(request, lookup_options).await
     }
 
-    async fn get_nsec_records(
+    async fn nsec_records(
         &self,
         name: &LowerName,
         lookup_options: LookupOptions,
-    ) -> Result<Self::Lookup, LookupError> {
-        self.inner.get_nsec_records(name, lookup_options).await
+    ) -> LookupControlFlow<AuthLookup> {
+        self.inner.nsec_records(name, lookup_options).await
     }
 }
 
diff --git a/dns-server/src/dns_server/tests.rs b/dns-server/src/dns_server/tests.rs
index 57b8f2474f..892fa72a86 100644
--- a/dns-server/src/dns_server/tests.rs
+++ b/dns-server/src/dns_server/tests.rs
@@ -19,10 +19,10 @@ use std::{
     sync::Arc,
 };
 
-use hickory_client::rr::{RData, RecordType};
+use hickory_proto::rr::{RData, RecordType};
 use hickory_server::{
-    authority::{Authority, ZoneType},
-    store::in_memory::InMemoryAuthority,
+    store::in_memory::InMemoryZoneHandler,
+    zone_handler::{AxfrPolicy, LookupOptions, ZoneHandler, ZoneType},
 };
 
 use common::{
@@ -61,7 +61,7 @@ async fn dns_server_basic() {
         version: SemVer::new(1, 2, 3),
     };
 
-    let inner = InMemoryAuthority::empty(host.clone(), ZoneType::Primary, false);
+    let inner = InMemoryZoneHandler::empty(host.clone(), ZoneType::Primary, AxfrPolicy::Deny);
 
     let auth = AuthorityImpl {
         config,
@@ -83,26 +83,36 @@ async fn dns_server_basic() {
     assert_eq!(auth.ipv6_addrs.lock().unwrap().len(), 1);
 
     let result_a = auth
-        .lookup(&host.clone().into(), RecordType::A, Default::default())
+        .lookup(
+            &host.clone().into(),
+            RecordType::A,
+            None,
+            LookupOptions::default(),
+        )
         .await
-        .unwrap()
+        .expect("lookup must not fail")
         .unwrap_records()
         .iter()
         .cloned()
         .collect::<Vec<_>>();
     assert_eq!(result_a.len(), 1);
-    assert_eq!(result_a[0].data(), Some(&RData::A(ip1.into())));
+    assert_eq!(result_a[0].data, RData::A(ip1.into()));
 
     let result_aaaa = auth
-        .lookup(&host.clone().into(), RecordType::AAAA, Default::default())
+        .lookup(
+            &host.clone().into(),
+            RecordType::AAAA,
+            None,
+            LookupOptions::default(),
+        )
         .await
-        .unwrap()
+        .expect("lookup must not fail")
         .unwrap_records()
         .iter()
         .cloned()
         .collect::<Vec<_>>();
     assert_eq!(result_aaaa.len(), 1);
-    assert_eq!(result_aaaa[0].data(), Some(&RData::AAAA(ip2.into())));
+    assert_eq!(result_aaaa[0].data, RData::AAAA(ip2.into()));
 
     handle_command(&auth, DnsServerCommand::DelAddress(ip1.into()));
     handle_command(&auth, DnsServerCommand::DelAddress(ip2.into()));
@@ -145,7 +155,8 @@ mod same_software_version_addr_selection_test {
         };
         let cur_soft_info = SoftwareInfo::current(&chain_config);
 
-        let inner = InMemoryAuthority::empty(config.host.clone(), ZoneType::Primary, false);
+        let inner =
+            InMemoryZoneHandler::empty(config.host.clone(), ZoneType::Primary, AxfrPolicy::Deny);
         let auth = AuthorityImpl {
             config,
             chain_config: Arc::clone(&chain_config),
@@ -170,7 +181,7 @@ mod same_software_version_addr_selection_test {
         let selected_v4_addrs = records[0]
             .1
             .records_without_rrsigs()
-            .map(|rec| assert_matches_return_val!(rec.data(), Some(&RData::A(a)), a.0))
+            .map(|rec| assert_matches_return_val!(&rec.data, RData::A(a), a.0))
             .collect::<Vec<_>>();
         assert_eq!(
             selected_v4_addrs.len(),
@@ -188,7 +199,7 @@ mod same_software_version_addr_selection_test {
         let selected_v6_addrs = records[1]
             .1
             .records_without_rrsigs()
-            .map(|rec| assert_matches_return_val!(rec.data(), Some(&RData::AAAA(a)), a.0))
+            .map(|rec| assert_matches_return_val!(&rec.data, RData::AAAA(a), a.0))
             .collect::<Vec<_>>();
         assert_eq!(
             selected_v6_addrs.len(),
diff --git a/dns-server/src/error.rs b/dns-server/src/error.rs
index c48cdd8548..3647523437 100644
--- a/dns-server/src/error.rs
+++ b/dns-server/src/error.rs
@@ -15,7 +15,8 @@
 
 use std::net::AddrParseError;
 
-use hickory_client::proto::error::ProtoError;
+use hickory_proto::ProtoError;
+use hickory_server::net::NetError;
 use p2p::{error::P2pError, peer_manager::peerdb_common};
 use thiserror::Error;
 use utils::try_as::TryAsRef;
@@ -24,6 +25,8 @@ use utils::try_as::TryAsRef;
 pub enum DnsServerError {
     #[error("Proto error: {0}")]
     ProtoError(#[from] ProtoError),
+    #[error("Net error: {0}")]
+    NetError(#[from] NetError),
     #[error("Parse error: {0}")]
     AddrParseError(#[from] AddrParseError),
     #[error("IO error: {0}")]
@@ -47,6 +50,7 @@ impl TryAsRef<storage::Error> for DnsServerError {
     fn try_as_ref(&self) -> Option<&storage::Error> {
         match self {
             DnsServerError::ProtoError(_)
+            | DnsServerError::NetError(_)
             | DnsServerError::AddrParseError(_)
             | DnsServerError::IoError(_)
             | DnsServerError::P2pError(_)
diff --git a/dns-server/src/main.rs b/dns-server/src/main.rs
index d7dd4ae158..98bafc035a 100644
--- a/dns-server/src/main.rs
+++ b/dns-server/src/main.rs
@@ -143,6 +143,7 @@ async fn run(options: DnsServerRunOptions) -> anyhow::Result<Never> {
                     open_storage(open_storage_backend(storage_data_dir))
                 }
                 DnsServerError::ProtoError(_)
+                | DnsServerError::NetError(_)
                 | DnsServerError::AddrParseError(_)
                 | DnsServerError::IoError(_)
                 | DnsServerError::P2pError(_)
diff --git a/supply-chain/audits.toml b/supply-chain/audits.toml
index 85ecee7039..3cf4fb9c56 100644
--- a/supply-chain/audits.toml
+++ b/supply-chain/audits.toml
@@ -2075,13 +2075,13 @@ end = "2026-10-15"
 
 [[trusted.zerocopy]]
 criteria = "safe-to-deploy"
-user-id = 7178 # Joshua Liebow-Feeser (joshlf)
+user-id = 7178 # Josh Liebow-Feeser (joshlf)
 start = "2019-02-28"
 end = "2026-10-15"
 
 [[trusted.zerocopy-derive]]
 criteria = "safe-to-deploy"
-user-id = 7178 # Joshua Liebow-Feeser (joshlf)
+user-id = 7178 # Josh Liebow-Feeser (joshlf)
 start = "2019-02-28"
 end = "2026-10-15"
 
diff --git a/supply-chain/config.toml b/supply-chain/config.toml
index e58e59915e..5edc91f9df 100644
--- a/supply-chain/config.toml
+++ b/supply-chain/config.toml
@@ -34,6 +34,9 @@ audit-as-crates-io = true
 [policy.iced_aw]
 audit-as-crates-io = true
 
+[policy.iced_glyphon]
+audit-as-crates-io = true
+
 [policy.ledger-lib]
 audit-as-crates-io = true
 
@@ -116,10 +119,6 @@ criteria = "safe-to-deploy"
 version = "0.4.10"
 criteria = "safe-to-deploy"
 
-[[exemptions.bincode]]
-version = "1.3.3"
-criteria = "safe-to-deploy"
-
 [[exemptions.bip39]]
 version = "2.2.2"
 criteria = "safe-to-deploy"
@@ -132,6 +131,10 @@ criteria = "safe-to-deploy"
 version = "0.1.6"
 criteria = "safe-to-deploy"
 
+[[exemptions.block-buffer]]
+version = "0.12.1"
+criteria = "safe-to-deploy"
+
 [[exemptions.block2]]
 version = "0.5.1"
 criteria = "safe-to-deploy"
@@ -208,10 +211,18 @@ criteria = "safe-to-deploy"
 version = "1.1.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.chacha20]]
+version = "0.10.2"
+criteria = "safe-to-deploy"
+
 [[exemptions.clipboard-win]]
 version = "5.4.1"
 criteria = "safe-to-deploy"
 
+[[exemptions.cmov]]
+version = "0.5.4"
+criteria = "safe-to-deploy"
+
 [[exemptions.com]]
 version = "0.6.0"
 criteria = "safe-to-deploy"
@@ -232,6 +243,10 @@ criteria = "safe-to-deploy"
 version = "2.5.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.const-oid]]
+version = "0.10.2"
+criteria = "safe-to-deploy"
+
 [[exemptions.const_format]]
 version = "0.2.35"
 criteria = "safe-to-deploy"
@@ -272,6 +287,14 @@ criteria = "safe-to-run"
 version = "0.5.0"
 criteria = "safe-to-run"
 
+[[exemptions.critical-section]]
+version = "1.2.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.crypto-common]]
+version = "0.2.2"
+criteria = "safe-to-deploy"
+
 [[exemptions.ctor]]
 version = "0.10.1"
 criteria = "safe-to-deploy"
@@ -284,6 +307,10 @@ criteria = "safe-to-deploy"
 version = "0.0.13"
 criteria = "safe-to-deploy"
 
+[[exemptions.ctutils]]
+version = "0.4.2"
+criteria = "safe-to-deploy"
+
 [[exemptions.cursor-icon]]
 version = "1.2.0"
 criteria = "safe-to-deploy"
@@ -360,6 +387,10 @@ criteria = "safe-to-deploy"
 version = "0.4.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.digest]]
+version = "0.11.3"
+criteria = "safe-to-deploy"
+
 [[exemptions.directories]]
 version = "5.0.1"
 criteria = "safe-to-deploy"
@@ -448,10 +479,6 @@ criteria = "safe-to-deploy"
 version = "1.0.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.endian-type]]
-version = "0.1.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.enum-iterator]]
 version = "2.3.0"
 criteria = "safe-to-deploy"
@@ -624,10 +651,22 @@ criteria = "safe-to-deploy"
 version = "0.2.1"
 criteria = "safe-to-deploy"
 
+[[exemptions.hickory-net]]
+version = "0.26.3"
+criteria = "safe-to-deploy"
+
 [[exemptions.hidapi]]
 version = "2.6.4"
 criteria = "safe-to-deploy"
 
+[[exemptions.hmac]]
+version = "0.13.0"
+criteria = "safe-to-deploy"
+
+[[exemptions.hybrid-array]]
+version = "0.4.10"
+criteria = "safe-to-deploy"
+
 [[exemptions.hyper-timeout]]
 version = "0.5.2"
 criteria = "safe-to-deploy"
@@ -644,6 +683,10 @@ criteria = "safe-to-deploy"
 version = "0.1.1"
 criteria = "safe-to-deploy"
 
+[[exemptions.iced_glyphon]]
+version = "0.6.0@git:acb3fc10a3a15ee6e0e7da4e264db2338c09a7c1"
+criteria = "safe-to-deploy"
+
 [[exemptions.impl-trait-for-tuples]]
 version = "0.2.3"
 criteria = "safe-to-deploy"
@@ -660,10 +703,26 @@ criteria = "safe-to-run"
 version = "0.19.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.jni]]
+version = "0.22.4"
+criteria = "safe-to-deploy"
+
+[[exemptions.jni-macros]]
+version = "0.22.4"
+criteria = "safe-to-deploy"
+
 [[exemptions.jni-sys]]
 version = "0.3.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.jni-sys]]
+version = "0.4.1"
+criteria = "safe-to-deploy"
+
+[[exemptions.jni-sys-macros]]
+version = "0.4.1"
+criteria = "safe-to-deploy"
+
 [[exemptions.jni-utils]]
 version = "0.1.1"
 criteria = "safe-to-deploy"
@@ -749,7 +808,7 @@ version = "0.2.1"
 criteria = "safe-to-deploy"
 
 [[exemptions.lru]]
-version = "0.12.5"
+version = "0.16.4"
 criteria = "safe-to-deploy"
 
 [[exemptions.lyon]]
@@ -780,6 +839,10 @@ criteria = "safe-to-deploy"
 version = "0.8.4"
 criteria = "safe-to-deploy"
 
+[[exemptions.md-5]]
+version = "0.11.0"
+criteria = "safe-to-deploy"
+
 [[exemptions.memmap2]]
 version = "0.9.9"
 criteria = "safe-to-deploy"
@@ -820,10 +883,6 @@ criteria = "safe-to-deploy"
 version = "0.6.0+11769913"
 criteria = "safe-to-deploy"
 
-[[exemptions.nibble_vec]]
-version = "0.1.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.nix]]
 version = "0.29.0"
 criteria = "safe-to-deploy"
@@ -876,10 +935,6 @@ criteria = "safe-to-deploy"
 version = "0.2.2"
 criteria = "safe-to-deploy"
 
-[[exemptions.objc2-core-graphics]]
-version = "0.3.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.objc2-core-image]]
 version = "0.2.2"
 criteria = "safe-to-deploy"
@@ -988,16 +1043,20 @@ criteria = "safe-to-run"
 version = "0.4.0"
 criteria = "safe-to-deploy"
 
+[[exemptions.portable-atomic]]
+version = "1.15.0"
+criteria = "safe-to-deploy"
+
 [[exemptions.ppv-lite86]]
 version = "0.2.21"
 criteria = "safe-to-deploy"
 
-[[exemptions.prettytable-rs]]
-version = "0.10.0"
+[[exemptions.prefix-trie]]
+version = "0.8.4"
 criteria = "safe-to-deploy"
 
-[[exemptions.probabilistic-collections]]
-version = "0.7.0"
+[[exemptions.prettytable-rs]]
+version = "0.10.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.proc-macro-crate]]
@@ -1060,38 +1119,14 @@ criteria = "safe-to-deploy"
 version = "0.7.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.radix_trie]]
-version = "0.2.1"
-criteria = "safe-to-deploy"
-
-[[exemptions.rand]]
-version = "0.7.3"
-criteria = "safe-to-deploy"
-
-[[exemptions.rand_chacha]]
-version = "0.2.2"
-criteria = "safe-to-deploy"
-
 [[exemptions.rand_chacha]]
 version = "0.10.0"
 criteria = "safe-to-deploy"
 
-[[exemptions.rand_core]]
-version = "0.5.1"
-criteria = "safe-to-deploy"
-
 [[exemptions.rand_core]]
 version = "0.10.1"
 criteria = "safe-to-deploy"
 
-[[exemptions.rand_hc]]
-version = "0.2.0"
-criteria = "safe-to-deploy"
-
-[[exemptions.rand_xorshift]]
-version = "0.2.0"
-criteria = "safe-to-deploy"
-
 [[exemptions.range-alloc]]
 version = "0.1.4"
 criteria = "safe-to-deploy"
@@ -1252,6 +1287,10 @@ criteria = "safe-to-run"
 version = "3.5.0"
 criteria = "safe-to-run"
 
+[[exemptions.sha2]]
+version = "0.11.0"
+criteria = "safe-to-deploy"
+
 [[exemptions.signal-hook]]
 version = "0.3.18"
 criteria = "safe-to-deploy"
@@ -1268,8 +1307,8 @@ criteria = "safe-to-deploy"
 version = "0.3.8"
 criteria = "safe-to-deploy"
 
-[[exemptions.simdutf8]]
-version = "0.1.5"
+[[exemptions.simd_cesu8]]
+version = "1.2.0"
 criteria = "safe-to-deploy"
 
 [[exemptions.slave-pool]]
diff --git a/supply-chain/imports.lock b/supply-chain/imports.lock
index c39d030f85..7ccea6f8dd 100644
--- a/supply-chain/imports.lock
+++ b/supply-chain/imports.lock
@@ -397,7 +397,7 @@ version = "0.1.1"
 when = "2020-09-15"
 user-id = 2396
 user-login = "jdm"
-user-name = "Josh Matthews"
+user-name = "Josh Bowman-Matthews"
 
 [[publisher.cpufeatures]]
 version = "0.2.17"
@@ -553,13 +553,6 @@ user-id = 6423
 user-login = "zeenix"
 user-name = "Zeeshan Ali Khan"
 
-[[publisher.enum-as-inner]]
-version = "0.6.1"
-when = "2024-09-09"
-user-id = 1300
-user-login = "bluejekyll"
-user-name = "Benjamin Fry"
-
 [[publisher.errno]]
 version = "0.3.14"
 when = "2025-09-09"
@@ -630,13 +623,6 @@ user-id = 33035
 user-login = "taiki-e"
 user-name = "Taiki Endo"
 
-[[publisher.getrandom]]
-version = "0.1.16"
-when = "2020-12-31"
-user-id = 5059
-user-login = "newpavlov"
-user-name = "Artyom Pavlov"
-
 [[publisher.getrandom]]
 version = "0.2.17"
 when = "2026-01-11"
@@ -711,23 +697,16 @@ user-id = 1588
 user-login = "apoelstra"
 user-name = "Andrew Poelstra"
 
-[[publisher.hickory-client]]
-version = "0.24.4"
-when = "2025-02-19"
-user-id = 1300
-user-login = "bluejekyll"
-user-name = "Benjamin Fry"
-
 [[publisher.hickory-proto]]
-version = "0.24.4"
-when = "2025-02-19"
+version = "0.26.3"
+when = "2026-09-10"
 user-id = 1300
 user-login = "bluejekyll"
 user-name = "Benjamin Fry"
 
 [[publisher.hickory-server]]
-version = "0.24.4"
-when = "2025-02-19"
+version = "0.26.3"
+when = "2026-09-10"
 user-id = 1300
 user-login = "bluejekyll"
 user-name = "Benjamin Fry"
@@ -809,13 +788,6 @@ user-id = 45266
 user-login = "hecrj"
 user-name = "Héctor"
 
-[[publisher.iced_glyphon]]
-version = "0.6.0"
-when = "2024-09-18"
-user-id = 45266
-user-login = "hecrj"
-user-name = "Héctor"
-
 [[publisher.iced_graphics]]
 version = "0.13.0"
 when = "2024-09-18"
@@ -1009,13 +981,6 @@ user-id = 6741
 user-login = "Darksonn"
 user-name = "Alice Ryhl"
 
-[[publisher.md-5]]
-version = "0.10.6"
-when = "2023-09-22"
-user-id = 5059
-user-login = "newpavlov"
-user-name = "Artyom Pavlov"
-
 [[publisher.memchr]]
 version = "2.8.0"
 when = "2026-02-06"
@@ -1234,15 +1199,15 @@ user-login = "tarcieri"
 user-name = "Tony Arcieri"
 
 [[publisher.postgres-protocol]]
-version = "0.6.10"
-when = "2026-01-14"
+version = "0.6.12"
+when = "2026-06-12"
 user-id = 55015
 user-login = "paolobarbolini"
 user-name = "Paolo Barbolini"
 
 [[publisher.postgres-types]]
-version = "0.2.12"
-when = "2026-01-14"
+version = "0.2.14"
+when = "2026-06-12"
 user-id = 55015
 user-login = "paolobarbolini"
 user-name = "Paolo Barbolini"
@@ -1401,8 +1366,8 @@ user-login = "sunfishcode"
 user-name = "Dan Gohman"
 
 [[publisher.rustls]]
-version = "0.23.36"
-when = "2026-01-05"
+version = "0.23.45"
+when = "2026-09-14"
 user-id = 2751
 user-login = "ctz"
 user-name = "Joe Birr-Pixton"
@@ -1436,11 +1401,11 @@ user-login = "cpu"
 user-name = "Daniel McCarney"
 
 [[publisher.rustls-webpki]]
-version = "0.103.13"
-when = "2026-04-21"
-user-id = 2751
-user-login = "ctz"
-user-name = "Joe Birr-Pixton"
+version = "0.103.15"
+when = "2026-08-21"
+user-id = 209038
+user-login = "cpu"
+user-name = "Daniel McCarney"
 
 [[publisher.rustversion]]
 version = "1.0.22"
@@ -1575,13 +1540,6 @@ user-id = 5059
 user-login = "newpavlov"
 user-name = "Artyom Pavlov"
 
-[[publisher.siphasher]]
-version = "0.3.11"
-when = "2023-08-23"
-user-id = 468
-user-login = "jedisct1"
-user-name = "Frank Denis"
-
 [[publisher.siphasher]]
 version = "1.0.2"
 when = "2026-01-27"
@@ -1702,8 +1660,8 @@ user-login = "Darksonn"
 user-name = "Alice Ryhl"
 
 [[publisher.tokio-postgres]]
-version = "0.7.16"
-when = "2026-01-14"
+version = "0.7.18"
+when = "2026-06-12"
 user-id = 55015
 user-login = "paolobarbolini"
 user-name = "Paolo Barbolini"
@@ -1939,13 +1897,6 @@ user-id = 189
 user-login = "BurntSushi"
 user-name = "Andrew Gallant"
 
-[[publisher.wasi]]
-version = "0.9.0+wasi-snapshot-preview1"
-when = "2019-12-02"
-user-id = 6825
-user-login = "sunfishcode"
-user-name = "Dan Gohman"
-
 [[publisher.wasi]]
 version = "0.11.1+wasi-snapshot-preview1"
 when = "2025-06-10"
@@ -2046,13 +1997,6 @@ user-id = 64539
 user-login = "kennykerr"
 user-name = "Kenny Kerr"
 
-[[publisher.windows-core]]
-version = "0.62.2"
-when = "2025-10-06"
-user-id = 64539
-user-login = "kennykerr"
-user-name = "Kenny Kerr"
-
 [[publisher.windows-future]]
 version = "0.2.1"
 when = "2025-05-15"
@@ -2515,14 +2459,14 @@ version = "0.8.39"
 when = "2026-02-05"
 user-id = 7178
 user-login = "joshlf"
-user-name = "Joshua Liebow-Feeser"
+user-name = "Josh Liebow-Feeser"
 
 [[publisher.zerocopy-derive]]
 version = "0.8.39"
 when = "2026-02-05"
 user-id = 7178
 user-login = "joshlf"
-user-name = "Joshua Liebow-Feeser"
+user-name = "Josh Liebow-Feeser"
 
 [[publisher.zeroize]]
 version = "1.8.2"
@@ -4184,11 +4128,6 @@ who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
 version = "0.9.0"
 
-[[audits.isrg.audits.chacha20]]
-who = "David Cook <dcook@divviup.org>"
-criteria = "safe-to-deploy"
-version = "0.10.0"
-
 [[audits.isrg.audits.cpufeatures]]
 who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
@@ -4446,7 +4385,7 @@ aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-ch
 [[audits.mozilla.wildcard-audits.core-graphics-types]]
 who = "Bobby Holley <bobbyholley@gmail.com>"
 criteria = "safe-to-deploy"
-user-id = 2396 # Josh Matthews (jdm)
+user-id = 2396 # Josh Bowman-Matthews (jdm)
 start = "2020-07-20"
 end = "2023-05-04"
 renew = false
@@ -4458,8 +4397,8 @@ who = "Henri Sivonen <hsivonen@hsivonen.fi>"
 criteria = "safe-to-deploy"
 user-id = 4484 # Henri Sivonen (hsivonen)
 start = "2019-02-26"
-end = "2025-10-23"
-notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others. There are two caveats to the certification: 1) The crate does things that are documented to be UB but that do not appear to actually be UB due to integer types differing from the general rule; https://github.com/hsivonen/encoding_rs/issues/79 . 2) It would be prudent to re-review the code that reinterprets buffers of integers as SIMD vectors; see https://github.com/hsivonen/encoding_rs/issues/87 ."
+end = "2027-09-07"
+notes = "I, Henri Sivonen, wrote encoding_rs for Gecko and have reviewed contributions by others."
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
 [[audits.mozilla.wildcard-audits.etagere]]
@@ -5088,6 +5027,22 @@ https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_so
 """
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.objc2-core-graphics]]
+who = "Andy Leiserson <aleiserson@mozilla.com>"
+criteria = "safe-to-deploy"
+version = "0.3.2"
+notes = """
+Contains substantial unsafe code, as is typical for FFI.
+
+The (non-published) `header-translator` crate that produces generated bindings
+in this crate was also reviewed, in lieu of a full review of the generated
+bindings.
+
+Users of this crate should be aware of the information in
+https://github.com/madsmtm/objc2/blob/main/crates/objc2/src/topics/frameworks_soundness.md.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.objc2-encode]]
 who = "Andy Leiserson <aleiserson@mozilla.com>"
 criteria = "safe-to-deploy"
@@ -5297,6 +5252,13 @@ criteria = "safe-to-deploy"
 delta = "1.1.0 -> 1.3.0"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.simdutf8]]
+who = "Henri Sivonen <hsivonen@hsivonen.fi>"
+criteria = "safe-to-deploy"
+version = "0.1.5"
+notes = "Confidence in correctness of the algorithm is based on fuzzing the SSE 4.2 and AVX2 implementations rather than working through the logic of the code. Audit of aarch64 and Wasm is by comparing the code with the SSE 4.2 case."
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.smallvec]]
 who = "Erich Gubler <erichdongubler@gmail.com>"
 criteria = "safe-to-deploy"
diff --git a/utils/Cargo.toml b/utils/Cargo.toml
index 07bf8959a6..eac3709fe8 100644
--- a/utils/Cargo.toml
+++ b/utils/Cargo.toml
@@ -21,8 +21,8 @@ fixed-hash.workspace = true
 heck.workspace = true
 num-traits.workspace = true
 parity-scale-codec.workspace = true
-probabilistic-collections.workspace = true
 qrcodegen.workspace = true
+siphasher.workspace = true
 slave-pool.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, default-features = false, features = ["macros", "rt", "sync", "tracing"] }
diff --git a/utils/src/bloom_filters/bloom_filter.rs b/utils/src/bloom_filters/bloom_filter.rs
index 4577b9dc2e..129ff44f16 100644
--- a/utils/src/bloom_filters/bloom_filter.rs
+++ b/utils/src/bloom_filters/bloom_filter.rs
@@ -13,14 +13,39 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-use std::{fmt::Debug, hash::Hash};
-
-use probabilistic_collections::SipHasherBuilder;
+use std::{
+    fmt::Debug,
+    hash::{Hash, Hasher},
+    marker::PhantomData,
+};
 
 use randomness::{Rng, RngExt as _};
+use siphasher::sip::SipHasher13;
 
 /// A space-efficient probabilistic data structure to test for membership in a set.
-pub struct BloomFilter<T>(probabilistic_collections::bloom::BloomFilter<T>);
+///
+/// Items can be added, but never removed. `contains` never produces false negatives,
+/// but may produce false positives with a probability of approximately `fpp` for filters
+/// that contain no more than `size` items.
+///
+/// We used to depend on the `probabilistic_collections` crate here, but it is
+/// abandoned (and pulls in the vulnerable `rand` 0.7), so this is a minimal
+/// reimplementation of the functionality that we need.
+pub struct BloomFilter<T> {
+    /// The bit array, storing `bit_count` bits
+    bits: Vec<u64>,
+
+    /// The number of bits in the bit array (commonly denoted as `m`)
+    bit_count: usize,
+
+    /// The number of hash functions (commonly denoted as `k`)
+    hash_count: u32,
+
+    /// The pair of hashers used to derive the item indices (Kirsch-Mitzenmacher scheme)
+    hashers: [SipHasher13; 2],
+
+    _phantom: PhantomData<fn(&T)>,
+}
 
 impl<T: Hash> BloomFilter<T> {
     /// Constructs a new, empty `BloomFilter` with an estimated max capacity of `size` items,
@@ -28,31 +53,86 @@ impl<T: Hash> BloomFilter<T> {
     pub fn new(size: usize, fpp: f64, rng: &mut impl Rng) -> Self {
         assert!(size > 0);
         assert!(fpp > 0.0 && fpp < 1.0);
-        Self(
-            probabilistic_collections::bloom::BloomFilter::<T>::with_hashers(
-                size,
-                fpp,
-                [
-                    SipHasherBuilder::from_seed(rng.random(), rng.random()),
-                    SipHasherBuilder::from_seed(rng.random(), rng.random()),
-                ],
-            ),
-        )
+
+        // The optimal number of bits per item: -log2(fpp) / (ln(2)^2)
+        #[allow(clippy::float_arithmetic)]
+        let (bit_count, hash_count) = {
+            let ln2 = std::f64::consts::LN_2;
+            let bit_count = -((size as f64) * fpp.ln()) / (ln2 * ln2);
+            let hash_count = ((bit_count / size as f64) * ln2).round();
+
+            (
+                bit_count.ceil() as usize,
+                // Round to the nearest integer, but ensure at least one hash function.
+                std::cmp::max(hash_count as u32, 1),
+            )
+        };
+
+        Self {
+            bits: vec![0; bit_count.div_ceil(u64::BITS as usize)],
+            bit_count,
+            hash_count,
+            hashers: [
+                SipHasher13::new_with_keys(rng.random(), rng.random()),
+                SipHasher13::new_with_keys(rng.random(), rng.random()),
+            ],
+            _phantom: PhantomData,
+        }
+    }
+
+    fn indices(&self, value: &T) -> impl Iterator<Item = usize> {
+        Self::compute_indices(&self.hashers, self.bit_count, self.hash_count, value)
+    }
+
+    /// Computes the bit indices for the given value. Takes all the parameters by value or
+    /// reference to local data (as opposed to borrowing from `self`), so that it can be used
+    /// while `self.bits` is being mutated without any borrow gymnastics or allocations.
+    fn compute_indices(
+        hashers: &[SipHasher13; 2],
+        bit_count: usize,
+        hash_count: u32,
+        value: &T,
+    ) -> impl Iterator<Item = usize> {
+        let hashes: [u64; 2] = {
+            let mut hash1 = hashers[0];
+            let mut hash2 = hashers[1];
+            value.hash(&mut hash1);
+            value.hash(&mut hash2);
+            [hash1.finish(), hash2.finish()]
+        };
+
+        let bit_count = bit_count as u64;
+        (0..hash_count).map(move |i| {
+            // Enhanced double hashing: h1 + i*h2 + i^2, modulo the number of bits.
+            // (The extra quadratic term distinguishes it from the canonical
+            // Kirsch-Mitzenmacher scheme, which is fine for a bloom filter as long as
+            // the index mapping is deterministic.) 128-bit arithmetic avoids overflows.
+            let idx = (hashes[0] as u128)
+                .wrapping_add((i as u128) * (hashes[1] as u128))
+                .wrapping_add((i as u128) * (i as u128));
+            (idx % bit_count as u128) as usize
+        })
     }
 
     /// Inserts an element into the bloom filter
     pub fn insert(&mut self, value: &T) {
-        self.0.insert(value);
+        let hashers = self.hashers;
+        let bit_count = self.bit_count;
+        let hash_count = self.hash_count;
+        for idx in Self::compute_indices(&hashers, bit_count, hash_count, value) {
+            self.bits[idx / u64::BITS as usize] |= 1 << (idx % u64::BITS as usize);
+        }
     }
 
     /// Checks if an element is possibly in the bloom filter
     pub fn contains(&self, value: &T) -> bool {
-        self.0.contains(value)
+        self.indices(value)
+            .all(|idx| self.bits[idx / u64::BITS as usize] & (1 << (idx % u64::BITS as usize)) != 0)
     }
 
     /// Clears the bloom filter, removing all elements
     pub fn clear(&mut self) {
-        self.0.clear();
+        self.bits.fill(0);
     }
 }
 
@@ -61,3 +141,100 @@ impl<T> Debug for BloomFilter<T> {
         f.debug_tuple("BloomFilter").finish()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use test_utils::random::Seed;
+
+    use super::BloomFilter;
+
+    #[rstest::rstest]
+    #[trace]
+    #[case(Seed::from_entropy())]
+    fn no_false_negatives(#[case] seed: Seed) {
+        let mut rng = test_utils::random::make_seedable_rng(seed);
+        let mut filter = BloomFilter::<u64>::new(1000, 0.001, &mut rng);
+
+        for i in 0..1000u64 {
+            filter.insert(&i);
+        }
+
+        for i in 0..1000u64 {
+            assert!(filter.contains(&i), "false negative for {i}");
+        }
+    }
+
+    #[rstest::rstest]
+    #[trace]
+    #[case(Seed::from_entropy())]
+    fn false_positive_rate(#[case] seed: Seed) {
+        let mut rng = test_utils::random::make_seedable_rng(seed);
+        let mut filter = BloomFilter::<u64>::new(1000, 0.001, &mut rng);
+
+        for i in 0..1000u64 {
+            filter.insert(&i);
+        }
+
+        // Check 100k items that were never inserted and count the false positives.
+        // The expected number is about 100; the sanity bounds are generous.
+        let mut false_positives = 0;
+        for i in 10_000u64..110_000 {
+            if filter.contains(&i) {
+                false_positives += 1;
+            }
+        }
+        assert!(
+            false_positives > 10 && false_positives < 300,
+            "invalid number of false positives: {false_positives}"
+        );
+    }
+
+    #[rstest::rstest]
+    #[trace]
+    #[case(Seed::from_entropy())]
+    fn clear(#[case] seed: Seed) {
+        let mut rng = test_utils::random::make_seedable_rng(seed);
+        let mut filter = BloomFilter::<u64>::new(100, 0.01, &mut rng);
+
+        for i in 0..100u64 {
+            filter.insert(&i);
+        }
+
+        filter.clear();
+
+        // After clearing, most items must be reported as absent. Note that a bloom
+        // filter cannot guarantee this for previously inserted items, but a cleared
+        // (all-zero) filter must not report any false positives at all.
+        assert!(filter.bits.iter().all(|&word| word == 0));
+        for i in 0..100u64 {
+            assert!(!filter.contains(&i));
+        }
+    }
+
+    #[rstest::rstest]
+    #[trace]
+    #[case(Seed::from_entropy())]
+    fn randomized_hash_keys(#[case] seed: Seed) {
+        // Two filters constructed with different rng states must not share hash keys,
+        // otherwise persistent false positives would plague long-lived filters.
+        let mut rng = test_utils::random::make_seedable_rng(seed);
+        let filter1 = BloomFilter::<u64>::new(100, 0.01, &mut rng);
+        let filter2 = BloomFilter::<u64>::new(100, 0.01, &mut rng);
+
+        assert_ne!(
+            filter1.indices(&12345u64).collect::<Vec<_>>(),
+            filter2.indices(&12345u64).collect::<Vec<_>>(),
+        );
+    }
+
+    #[test]
+    fn deterministic_behavior() {
+        // The same item must always map to the same indices within a given filter.
+        let mut rng = randomness::make_pseudo_rng();
+        let mut filter = BloomFilter::<String>::new(100, 0.01, &mut rng);
+        filter.insert(&"hello".to_owned());
+
+        assert!(filter.contains(&"hello".to_owned()));
+        assert!(!filter.contains(&"world".to_owned()));
+    }
+}