diff --git a/Cargo.lock b/Cargo.lock
index f6b368b..bd66df5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1068,7 +1068,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml_ng",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "shaderc",
  "signalsmith-stretch",
  "skrifa 0.45.1",
diff --git a/crates/engine/Cargo.toml b/crates/engine/Cargo.toml
index 9acee72..04768e3 100644
--- a/crates/engine/Cargo.toml
+++ b/crates/engine/Cargo.toml
@@ -153,7 +153,7 @@ vello = { version = "0.11", default-features = false, features = ["wgpu"] }
 # docs/research/integrations.md §7.1.
 ureq = "2.12"
 # Model downloads are verified against a pinned SHA-256.
-sha2 = "0.10"
+sha2 = "0.11"
 # `secrets.toml` and `accounts.toml`.
 toml = "0.8"
 # ElevenLabs sends speech with timestamps as base64 inside JSON. Already in