diff --git a/Cargo.lock b/Cargo.lock
index d7bb2b00..35e53f29 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -369,6 +369,12 @@ version = "0.9.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
 
+[[package]]
+name = "const-oid"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
+
 [[package]]
 name = "core-foundation-sys"
 version = "0.8.7"
@@ -560,7 +566,7 @@ version = "0.7.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
 dependencies = [
- "const-oid",
+ "const-oid 0.9.6",
  "pem-rfc7468",
  "zeroize",
 ]
@@ -572,7 +578,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
- "const-oid",
+ "const-oid 0.9.6",
  "crypto-common 0.1.7",
  "subtle",
 ]
@@ -584,6 +590,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.1",
+ "const-oid 0.10.2",
  "crypto-common 0.2.2",
 ]
 
@@ -1410,7 +1417,7 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror",
  "tracing",
  "uuid",
@@ -1461,7 +1468,7 @@ dependencies = [
  "openmls_traits",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "thiserror",
  "tokio",
  "tracing",
@@ -1516,7 +1523,7 @@ dependencies = [
  "rand_core 0.6.4",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "subtle",
  "thiserror",
  "tracing",
diff --git a/Cargo.toml b/Cargo.toml
index a1a1b5e0..6675207d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -89,7 +89,7 @@ unicode-normalization = "0.1"
 # `ecdh` backs the NIP-44 v2 conversation key (secp256k1 ECDH, x-coordinate
 # only, deliberately unhashed) used to seal Nostr gift wraps.
 k256 = { version = "0.13", features = ["schnorr", "ecdh"] }
-sha2 = "0.10"
+sha2 = "0.11"
 hkdf = "0.12"
 # NIP-44 v2 is encrypt-then-MAC over a raw ChaCha20 stream — not an AEAD — so
 # it needs the bare stream cipher and HMAC rather than `chacha20poly1305`.
diff --git a/crates/offline-protocol-mls/Cargo.toml b/crates/offline-protocol-mls/Cargo.toml
index 58d68b50..9b22eeab 100644
--- a/crates/offline-protocol-mls/Cargo.toml
+++ b/crates/offline-protocol-mls/Cargo.toml
@@ -47,7 +47,7 @@ base64 = { workspace = true }
 hex = "0.4"
 
 # Hashing
-sha2 = "0.10"
+sha2 = "0.11"
 
 # Ed25519 for signature verification
 ed25519-dalek = { version = "3.0", features = ["digest"] }
diff --git a/crates/offline-protocol/Cargo.toml b/crates/offline-protocol/Cargo.toml
index 49061efe..fbec5283 100644
--- a/crates/offline-protocol/Cargo.toml
+++ b/crates/offline-protocol/Cargo.toml
@@ -35,7 +35,7 @@ base64 = { workspace = true }
 # The Nostr author key is hex on the wire and hex in the discovery record, so
 # the comparison that binds the two never crosses an encoding.
 hex = { workspace = true }
-sha2 = "0.10"
+sha2 = "0.11"
 chacha20poly1305 = { workspace = true }
 rand_core = { workspace = true }
 zeroize = { workspace = true }