diff --git a/cli/Cargo.lock b/cli/Cargo.lock
index 160bcb5b573a7..35798c7665b8d 100644
--- a/cli/Cargo.lock
+++ b/cli/Cargo.lock
@@ -453,7 +453,7 @@ dependencies = [
  "log",
  "open",
  "pin-project",
- "rand 0.8.6",
+ "rand 0.9.4",
  "regex",
  "reqwest",
  "rmp-serde",
@@ -3032,9 +3032,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index a8f1ba4c34e9d..4d3f24d0e9a45 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -27,7 +27,7 @@ serde_json = "1.0.96"
 rmp-serde = "1.1.1"
 uuid = { version = "1.4", features = ["serde", "v4"] }
 dirs = "5.0.1"
-rand = "0.8.6"
+rand = "0.9.4"
 serde_bytes = "0.11.9"
 jiff = { version = "0.2", default-features = false, features = ["std", "serde"] }
 http = "1"
@@ -54,7 +54,7 @@ cfg-if = "1.0.0"
 pin-project = "1.1.0"
 console = "0.15.7"
 bytes = "1.11.1"
-tar = "0.4.45"
+tar = "0.4.46"
 local-ip-address = "0.6"
 ahp = "0.1"
 ahp-types = "0.1"