diff --git a/Cargo.lock b/Cargo.lock
index 2a92839e2..26ee4ff0e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -88,7 +88,7 @@ dependencies = [
  "openssl",
  "percent-encoding",
  "pin-project-lite",
- "rand 0.9.3",
+ "rand 0.10.1",
  "rcgen",
  "regex",
  "rustls 0.23.37",
@@ -164,7 +164,7 @@ dependencies = [
  "memchr",
  "mime",
  "multer",
- "rand 0.9.3",
+ "rand 0.10.1",
  "serde",
  "serde_json",
  "serde_plain",
@@ -362,7 +362,7 @@ dependencies = [
  "once_cell",
  "openssl",
  "pin-project-lite",
- "rand 0.9.3",
+ "rand 0.10.1",
  "rcgen",
  "regex",
  "regex-lite",
@@ -424,7 +424,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -606,7 +606,7 @@ dependencies = [
  "openssl",
  "percent-encoding",
  "pin-project-lite",
- "rand 0.9.3",
+ "rand 0.10.1",
  "rcgen",
  "rustls 0.20.9",
  "rustls 0.21.12",
@@ -748,6 +748,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ciborium"
 version = "0.2.2"
@@ -917,6 +928,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -1423,6 +1443,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "r-efi 6.0.0",
+ "rand_core 0.10.1",
  "wasip2",
  "wasip3",
 ]
@@ -2211,7 +2232,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -2316,6 +2337,17 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.2",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.3.1"
@@ -2354,6 +2386,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rayon"
 version = "1.11.0"
@@ -2765,7 +2803,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -2776,7 +2814,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
diff --git a/actix-http/CHANGES.md b/actix-http/CHANGES.md
index a627718b0..32a997db9 100644
--- a/actix-http/CHANGES.md
+++ b/actix-http/CHANGES.md
@@ -4,6 +4,7 @@
 
 - Encode the HTTP/1 `Connection: Upgrade` header in Camel-Case when camel-case header formatting is enabled.[#3953]
 - Fix `HeaderMap` iterators' `len()` and `size_hint()` implementations for multi-value headers.
+- Update `rand` dependency to `0.10`.
 
 [#3953]: https://github.com/actix/actix-web/pull/3953
 
diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml
index 6495ebbf1..aee75a0a6 100644
--- a/actix-http/Cargo.toml
+++ b/actix-http/Cargo.toml
@@ -123,7 +123,7 @@ h2 = { version = "0.3.27", optional = true }
 # websockets
 base64 = { version = "0.22", optional = true }
 local-channel = { version = "0.1", optional = true }
-rand = { version = "0.9", optional = true }
+rand = { version = "0.10.1", optional = true }
 sha1 = { version = "0.10", optional = true }
 
 # openssl/rustls
diff --git a/actix-http/tests/test_server.rs b/actix-http/tests/test_server.rs
index 4b4e435bd..6cbb680d5 100644
--- a/actix-http/tests/test_server.rs
+++ b/actix-http/tests/test_server.rs
@@ -19,7 +19,7 @@ use actix_utils::future::{err, ok, ready};
 use bytes::Bytes;
 use derive_more::{Display, Error};
 use futures_util::{stream::once, FutureExt as _, StreamExt as _};
-use rand::Rng as _;
+use rand::RngExt as _;
 use regex::Regex;
 
 #[actix_rt::test]
diff --git a/actix-multipart/CHANGES.md b/actix-multipart/CHANGES.md
index 13c18038b..5e614a81e 100644
--- a/actix-multipart/CHANGES.md
+++ b/actix-multipart/CHANGES.md
@@ -5,6 +5,7 @@
 - Add multi-field multipart payload builders to `actix_multipart::test`. [#3575]
 - Add `MultipartForm` support for `Option<Vec<T>>` fields. [#3577]
 - Minimum supported Rust version (MSRV) is now 1.88.
+- Update `rand` dependency to `0.10`.
 
 [#3577]: https://github.com/actix/actix-web/pull/3577
 [#3575]: https://github.com/actix/actix-web/issues/3575
diff --git a/actix-multipart/Cargo.toml b/actix-multipart/Cargo.toml
index 384430f06..29c30df7b 100644
--- a/actix-multipart/Cargo.toml
+++ b/actix-multipart/Cargo.toml
@@ -49,7 +49,7 @@ local-waker = "0.1"
 log = "0.4"
 memchr = "2.5"
 mime = "0.3"
-rand = "0.9"
+rand = "0.10.1"
 serde = "1"
 serde_json = "1"
 serde_plain = "1"
diff --git a/actix-web/CHANGES.md b/actix-web/CHANGES.md
index b5a91cc95..1c48a27ce 100644
--- a/actix-web/CHANGES.md
+++ b/actix-web/CHANGES.md
@@ -7,6 +7,7 @@
 - Panic when calling `Route::to()` or `Route::service()` after `Route::wrap()` to prevent silently dropping route middleware. [#3944]
 - Fix `HttpRequest::{match_pattern,match_name}` reporting path-only matches when route guards disambiguate overlapping resources. [#3346]
 - Fix `Readlines` handling of lines split across payload chunks so combined line limits are enforced and complete lines are yielded.
+- Update `rand` dependency to `0.10`.
 
 [#3944]: https://github.com/actix/actix-web/pull/3944
 [#3346]: https://github.com/actix/actix-web/issues/3346
diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml
index 13b5615f7..bb24ab175 100644
--- a/actix-web/Cargo.toml
+++ b/actix-web/Cargo.toml
@@ -180,7 +180,7 @@ criterion = { version = "0.5", features = ["html_reports"] }
 env_logger = "0.11"
 flate2 = "1.0.13"
 futures-util = { version = "0.3.17", default-features = false, features = ["std"] }
-rand = "0.9"
+rand = "0.10.1"
 rcgen = "0.13"
 rustls-pki-types = "1.13.1"
 serde = { version = "1", features = ["derive"] }
diff --git a/awc/CHANGES.md b/awc/CHANGES.md
index 38a9f8b09..e523c0fc7 100644
--- a/awc/CHANGES.md
+++ b/awc/CHANGES.md
@@ -3,6 +3,7 @@
 ## Unreleased
 
 - Add camel-case header controls to `WebsocketsRequest` via `camel_case_headers()` and `set_camel_case_headers()`. [#3953]
+- Update `rand` dependency to `0.10`.
 
 [#3953]: https://github.com/actix/actix-web/pull/3953
 
diff --git a/awc/Cargo.toml b/awc/Cargo.toml
index b5b9396b0..86b319e42 100644
--- a/awc/Cargo.toml
+++ b/awc/Cargo.toml
@@ -117,7 +117,7 @@ log = "0.4"
 mime = "0.3"
 percent-encoding = "2.1"
 pin-project-lite = "0.2"
-rand = "0.9"
+rand = "0.10.1"
 serde = "1.0"
 serde_json = "1.0"
 serde_urlencoded = "0.7"