diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index f1e196d2..10070523 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -400,6 +400,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9"
+
 [[package]]
 name = "bit-set"
 version = "0.8.0"
@@ -7616,7 +7622,7 @@ dependencies = [
  "alsa",
  "anyhow",
  "axum",
- "base64 0.22.1",
+ "base64 0.23.0",
  "blake3",
  "chrono",
  "cpal",
@@ -7728,7 +7734,7 @@ dependencies = [
 name = "waveflow-spotify"
 version = "1.4.0"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.0",
  "chrono",
  "reqwest 0.12.28",
  "serde",
diff --git a/src-tauri/crates/app/Cargo.toml b/src-tauri/crates/app/Cargo.toml
index 3f625716..ac501c78 100644
--- a/src-tauri/crates/app/Cargo.toml
+++ b/src-tauri/crates/app/Cargo.toml
@@ -195,7 +195,7 @@ anyhow = "1"
 # track.updateNowPlaying) need an md5 of the param block + secret.
 md-5 = "0.11"
 hex = "0.4"
-base64 = "0.22"
+base64 = "0.23"
 sha2 = "0.11"
 
 # OS-level media controls: SMTC on Windows, MPRIS on Linux,
diff --git a/src-tauri/crates/spotify/Cargo.toml b/src-tauri/crates/spotify/Cargo.toml
index 3b7dac90..33dbe55d 100644
--- a/src-tauri/crates/spotify/Cargo.toml
+++ b/src-tauri/crates/spotify/Cargo.toml
@@ -35,7 +35,7 @@ serde_json = "1"
 chrono = "0.4"
 
 # PKCE — random verifier + SHA-256 challenge + base64url-no-pad encoding.
-base64 = "0.22"
+base64 = "0.23"
 sha2 = "0.11"
 uuid = { version = "1", features = ["v4"] }