diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml
index f164d8538..1d9a54a0d 100644
--- a/actix-http/Cargo.toml
+++ b/actix-http/Cargo.toml
@@ -132,7 +132,7 @@ h2 = { version = "0.3.26", optional = true }
 # websockets
 local-channel = { version = "0.1", optional = true }
 base64 = { version = "0.22", optional = true }
-rand = { version = "0.8", optional = true }
+rand = { version = "0.9", optional = true }
 sha1 = { version = "0.10", optional = true }
 
 # openssl/rustls
diff --git a/actix-multipart/Cargo.toml b/actix-multipart/Cargo.toml
index 62b53eb79..c0e62d8aa 100644
--- a/actix-multipart/Cargo.toml
+++ b/actix-multipart/Cargo.toml
@@ -50,7 +50,7 @@ local-waker = "0.1"
 log = "0.4"
 memchr = "2.5"
 mime = "0.3"
-rand = "0.8"
+rand = "0.9"
 serde = "1"
 serde_json = "1"
 serde_plain = "1"
diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml
index f4159cf27..f7d6f56d2 100644
--- a/actix-web/Cargo.toml
+++ b/actix-web/Cargo.toml
@@ -180,7 +180,7 @@ criterion = { version = "0.5", features = ["html_reports"] }
 env_logger = "0.11"
 flate2 = "1.0.13"
 futures-util = { version = "0.3.17", default-features = false, features = ["std"] }
-rand = "0.8"
+rand = "0.9"
 rcgen = "0.13"
 rustls-pemfile = "2"
 serde = { version = "1", features = ["derive"] }
diff --git a/awc/Cargo.toml b/awc/Cargo.toml
index d6626f906..e2e2bcd17 100644
--- a/awc/Cargo.toml
+++ b/awc/Cargo.toml
@@ -116,7 +116,7 @@ log =" 0.4"
 mime = "0.3"
 percent-encoding = "2.1"
 pin-project-lite = "0.2"
-rand = "0.8"
+rand = "0.9"
 serde = "1.0"
 serde_json = "1.0"
 serde_urlencoded = "0.7"