diff --git a/Cargo.lock b/Cargo.lock
index d07e0e5..3383823 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -543,6 +543,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
  "block-buffer 0.12.0",
+ "const-oid 0.10.2",
  "crypto-common 0.2.1",
 ]
 
@@ -1660,7 +1661,7 @@ dependencies = [
  "ecdsa",
  "elliptic-curve",
  "primeorder",
- "sha2",
+ "sha2 0.10.9",
 ]
 
 [[package]]
@@ -1692,7 +1693,7 @@ dependencies = [
  "serde_json",
  "serde_yaml",
  "sha1",
- "sha2",
+ "sha2 0.11.0",
  "subtle",
  "syslog",
  "tempfile",
@@ -1933,7 +1934,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_yaml",
- "sha2",
+ "sha2 0.11.0",
  "tempfile",
  "thiserror 1.0.69",
  "tokio",
@@ -2494,6 +2495,17 @@ dependencies = [
  "digest 0.10.7",
 ]
 
+[[package]]
+name = "sha2"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
+]
+
 [[package]]
 name = "sha3"
 version = "0.11.0"
diff --git a/pam-prmana/Cargo.toml b/pam-prmana/Cargo.toml
index 8f4ed48..e6d2506 100644
--- a/pam-prmana/Cargo.toml
+++ b/pam-prmana/Cargo.toml
@@ -51,7 +51,7 @@ getrandom = "0.3"
 parking_lot = "0.12"
 p256 = { version = "0.13", features = ["ecdsa"] }
 sha1 = "0.10"
-sha2 = "0.10"
+sha2 = "0.11"
 hmac = "0.12"
 # Base32 decoding for TOTP seeds (RFC 6238 / YubiKey OTP enrollment)
 data-encoding = "2.6"
diff --git a/prmana-agent/Cargo.toml b/prmana-agent/Cargo.toml
index 5cbf6a2..afac414 100644
--- a/prmana-agent/Cargo.toml
+++ b/prmana-agent/Cargo.toml
@@ -16,7 +16,7 @@ path = "src/main.rs"
 # implemented unconditionally in ecdsa-0.16 for SigningKey<C>. The `ecdsa` and
 # `jwk` features are all that is needed.
 p256 = { version = "0.13", features = ["ecdsa", "jwk"] }
-sha2 = "0.10"
+sha2 = "0.11"
 base64 = "0.21"
 # MEM-01/MEM-02: zeroize for Zeroizing<T> wrapper; ZeroizeOnDrop already implemented
 # unconditionally by ecdsa-0.16's SigningKey. secrecy is added for Plan 02+ usage.