diff --git a/Cargo.lock b/Cargo.lock
index 408401584..fa1b330af 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1169,7 +1169,7 @@ dependencies = [
  "glob-match",
  "log",
  "parking_lot",
- "rand",
+ "rand 0.8.5",
  "redis-protocol",
  "rustls 0.23.21",
  "rustls-native-certs 0.8.1",
@@ -1302,7 +1302,19 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a49c392881ce6d5c3b8cb70f98717b7c07aabbdff06687b9030dbfbe2725f8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.13.3+wasi-0.2.2",
+ "windows-targets",
 ]
 
 [[package]]
@@ -1950,7 +1962,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2886843bf800fba2e3377cff24abf6379b4c4d5c6681eaf9ea5b0d15090450bd"
 dependencies = [
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
  "windows-sys 0.52.0",
 ]
 
@@ -2109,7 +2121,7 @@ dependencies = [
  "parking_lot",
  "pretty_assertions",
  "prost",
- "rand",
+ "rand 0.9.0",
  "scopeguard",
  "serde",
  "serde_json",
@@ -2147,7 +2159,7 @@ dependencies = [
  "pretty_assertions",
  "prost",
  "prost-types",
- "rand",
+ "rand 0.9.0",
  "serde_json5",
  "tokio",
  "tokio-stream",
@@ -2196,7 +2208,7 @@ dependencies = [
  "patricia_tree",
  "pretty_assertions",
  "prost",
- "rand",
+ "rand 0.9.0",
  "serde",
  "serde_json",
  "sha2",
@@ -2238,7 +2250,7 @@ dependencies = [
  "pretty_assertions",
  "prost",
  "prost-types",
- "rand",
+ "rand 0.9.0",
  "rlimit",
  "serde",
  "serde_json",
@@ -2275,7 +2287,7 @@ dependencies = [
  "pretty_assertions",
  "prost",
  "prost-types",
- "rand",
+ "rand 0.9.0",
  "relative-path",
  "scopeguard",
  "serde",
@@ -2573,7 +2585,7 @@ version = "0.2.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77957b295656769bb8ad2b6a6b09d897d94f05c41b069aede1fcdaa675eaea04"
 dependencies = [
- "zerocopy",
+ "zerocopy 0.7.35",
 ]
 
 [[package]]
@@ -2718,8 +2730,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
 dependencies = [
  "libc",
- "rand_chacha",
- "rand_core",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3779b94aeb87e8bd4e834cee3650289ee9e0d5677f976ecdb6d219e5f4f6cd94"
+dependencies = [
+ "rand_chacha 0.9.0",
+ "rand_core 0.9.0",
+ "zerocopy 0.8.17",
 ]
 
 [[package]]
@@ -2729,7 +2752,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.6.4",
+]
+
+[[package]]
+name = "rand_chacha"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.9.0",
 ]
 
 [[package]]
@@ -2738,7 +2771,17 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
+]
+
+[[package]]
+name = "rand_core"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b08f3c9802962f7e1b25113931d94f43ed9725bebc59db9d0c3e9a23b67e15ff"
+dependencies = [
+ "getrandom 0.3.1",
+ "zerocopy 0.8.17",
 ]
 
 [[package]]
@@ -2828,7 +2871,7 @@ checksum = "c17fa4cb658e3583423e915b9f3acc01cceaee1860e33d59ebae66adc3a2dc0d"
 dependencies = [
  "cc",
  "cfg-if",
- "getrandom",
+ "getrandom 0.2.15",
  "libc",
  "spin",
  "untrusted",
@@ -3001,9 +3044,9 @@ checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
 
 [[package]]
 name = "scc"
-version = "2.3.0"
+version = "2.3.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "28e1c91382686d21b5ac7959341fcb9780fa7c03773646995a87c950fa7be640"
+checksum = "ea091f6cac2595aa38993f04f4ee692ed43757035c36e67c180b6828356385b1"
 dependencies = [
  "sdd",
 ]
@@ -3035,9 +3078,9 @@ dependencies = [
 
 [[package]]
 name = "sdd"
-version = "3.0.5"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "478f121bb72bbf63c52c93011ea1791dca40140dfe13f8336c4c5ac952c33aa9"
+checksum = "b07779b9b918cc05650cb30f404d4d7835d26df37c235eded8a6832e2fb82cca"
 
 [[package]]
 name = "security-framework"
@@ -3320,7 +3363,7 @@ checksum = "9a8a559c81686f576e8cd0290cd2a24a2a9ad80c98b3478856500fcbd7acd704"
 dependencies = [
  "cfg-if",
  "fastrand",
- "getrandom",
+ "getrandom 0.2.15",
  "once_cell",
  "rustix",
  "windows-sys 0.59.0",
@@ -3562,7 +3605,7 @@ dependencies = [
  "indexmap 1.9.3",
  "pin-project",
  "pin-project-lite",
- "rand",
+ "rand 0.8.5",
  "slab",
  "tokio",
  "tokio-util",
@@ -3755,7 +3798,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "744018581f9a3454a9e15beb8a33b017183f1e7c0cd170232a2d1453b23a51c4"
 dependencies = [
  "atomic",
- "getrandom",
+ "getrandom 0.2.15",
  "serde",
 ]
 
@@ -3792,6 +3835,15 @@ version = "0.11.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
+[[package]]
+name = "wasi"
+version = "0.13.3+wasi-0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.100"
@@ -3959,6 +4011,15 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+dependencies = [
+ "bitflags",
+]
+
 [[package]]
 name = "write16"
 version = "1.0.0"
@@ -4014,7 +4075,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b9b4fd18abc82b8136838da5d50bae7bdea537c574d8dc1a34ed098d6c166f0"
 dependencies = [
  "byteorder",
- "zerocopy-derive",
+ "zerocopy-derive 0.7.35",
+]
+
+[[package]]
+name = "zerocopy"
+version = "0.8.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa91407dacce3a68c56de03abe2760159582b846c6a4acd2f456618087f12713"
+dependencies = [
+ "zerocopy-derive 0.8.17",
 ]
 
 [[package]]
@@ -4028,6 +4098,17 @@ dependencies = [
  "syn 2.0.96",
 ]
 
+[[package]]
+name = "zerocopy-derive"
+version = "0.8.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06718a168365cad3d5ff0bb133aad346959a2074bd4a85c121255a11304a8626"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.96",
+]
+
 [[package]]
 name = "zerofrom"
 version = "0.1.5"
diff --git a/nativelink-macro/src/lib.rs b/nativelink-macro/src/lib.rs
index 98ea64e74..41a18276b 100644
--- a/nativelink-macro/src/lib.rs
+++ b/nativelink-macro/src/lib.rs
@@ -40,6 +40,7 @@ pub fn nativelink_test(attr: TokenStream, item: TokenStream) -> TokenStream {
             #[warn(clippy::disallowed_methods)]
             ::std::sync::Arc::new(::nativelink_util::origin_context::OriginContext::new()).wrap_async(
                 ::nativelink_util::__tracing::error_span!(stringify!(#fn_name)), async move {
+                    ::nativelink_util::common::reseed_rng_for_test().unwrap();
                     #fn_block
                 }
             )
diff --git a/nativelink-scheduler/Cargo.toml b/nativelink-scheduler/Cargo.toml
index da7fc7807..584550394 100644
--- a/nativelink-scheduler/Cargo.toml
+++ b/nativelink-scheduler/Cargo.toml
@@ -22,7 +22,7 @@ futures = { version = "0.3.31", default-features = false }
 lru = { version = "0.12.5", default-features = false }
 mock_instant = "0.5.2"
 parking_lot = "0.12.3"
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 scopeguard = { version = "1.2.0", default-features = false }
 tokio = { version = "1.43.0", features = ["fs", "rt-multi-thread", "signal", "io-util"], default-features = false }
 tokio-stream = { version = "0.1.17", features = ["fs"], default-features = false }
diff --git a/nativelink-scheduler/src/grpc_scheduler.rs b/nativelink-scheduler/src/grpc_scheduler.rs
index 63d3455d8..3c1d47523 100644
--- a/nativelink-scheduler/src/grpc_scheduler.rs
+++ b/nativelink-scheduler/src/grpc_scheduler.rs
@@ -41,7 +41,6 @@ use nativelink_util::origin_event::OriginMetadata;
 use nativelink_util::retry::{Retrier, RetryResult};
 use nativelink_util::{background_spawn, tls_utils};
 use parking_lot::Mutex;
-use rand::rngs::OsRng;
 use rand::Rng;
 use tokio::select;
 use tokio::sync::watch;
@@ -107,7 +106,7 @@ impl GrpcScheduler {
                 }
                 let min = 1. - (jitter_amt / 2.);
                 let max = 1. + (jitter_amt / 2.);
-                delay.mul_f32(OsRng.gen_range(min..max))
+                delay.mul_f32(rand::rng().random_range(min..max))
             }),
         )
     }
diff --git a/nativelink-service/Cargo.toml b/nativelink-service/Cargo.toml
index 37b9cc997..98b0152c7 100644
--- a/nativelink-service/Cargo.toml
+++ b/nativelink-service/Cargo.toml
@@ -16,7 +16,7 @@ futures = { version = "0.3.31", default-features = false }
 http-body = "1.0.1"
 http-body-util = "0.1.2"
 hyper = { version = "1.5.2" }
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 serde_json5 = "0.1.0"
 parking_lot = "0.12.3"
 prost = { version = "0.13.4", default-features = false }
diff --git a/nativelink-service/src/worker_api_server.rs b/nativelink-service/src/worker_api_server.rs
index 5ffa00ca8..0c029184f 100644
--- a/nativelink-service/src/worker_api_server.rs
+++ b/nativelink-service/src/worker_api_server.rs
@@ -58,9 +58,8 @@ impl WorkerApiServer {
         schedulers: &HashMap<String, Arc<dyn WorkerScheduler>>,
     ) -> Result<Self, Error> {
         let node_id = {
-            let mut rng = rand::thread_rng();
             let mut out = [0; 6];
-            rng.fill_bytes(&mut out);
+            rand::rng().fill_bytes(&mut out);
             out
         };
         for scheduler in schedulers.values() {
diff --git a/nativelink-store/Cargo.toml b/nativelink-store/Cargo.toml
index 0648a502e..379dbfeb4 100644
--- a/nativelink-store/Cargo.toml
+++ b/nativelink-store/Cargo.toml
@@ -53,7 +53,7 @@ hyper-rustls = { version = "0.24.2", default-features = false, features = [
 lz4_flex = { version = "0.11.3", default-features = false }
 parking_lot = "0.12.3"
 prost = { version = "0.13.4", default-features = false }
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 serde = { version = "1.0.217", default-features = false }
 tokio = { version = "1.43.0", features = ["fs", "rt-multi-thread", "signal", "io-util"], default-features = false }
 tokio-stream = { version = "0.1.17", features = ["fs"], default-features = false }
@@ -78,6 +78,7 @@ aws-sdk-s3 = { version = "=1.68.0", features = [
   "rt-tokio",
 ], default-features = false }
 aws-smithy-runtime-api = "1.7.3"
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng", "small_rng"] }
 serde_json = "1.0.135"
 fred = { version = "10.0.3", default-features = false, features = ["mocks"] }
 tracing-subscriber = { version = "0.3.19", default-features = false }
diff --git a/nativelink-store/src/grpc_store.rs b/nativelink-store/src/grpc_store.rs
index aaa1f0b0c..1fde1260c 100644
--- a/nativelink-store/src/grpc_store.rs
+++ b/nativelink-store/src/grpc_store.rs
@@ -51,7 +51,6 @@ use nativelink_util::store_trait::{StoreDriver, StoreKey, UploadSizeInfo};
 use nativelink_util::{default_health_status_indicator, tls_utils};
 use parking_lot::Mutex;
 use prost::Message;
-use rand::rngs::OsRng;
 use rand::Rng;
 use tokio::time::sleep;
 use tonic::{IntoRequest, Request, Response, Status, Streaming};
@@ -81,7 +80,7 @@ impl GrpcStore {
                 }
                 let min = 1. - (jitter_amt / 2.);
                 let max = 1. + (jitter_amt / 2.);
-                delay.mul_f32(OsRng.gen_range(min..max))
+                delay.mul_f32(rand::rng().random_range(min..max))
             }),
         )
         .await
diff --git a/nativelink-store/src/s3_store.rs b/nativelink-store/src/s3_store.rs
index 90b827293..f7e70e717 100644
--- a/nativelink-store/src/s3_store.rs
+++ b/nativelink-store/src/s3_store.rs
@@ -55,7 +55,6 @@ use nativelink_util::health_utils::{HealthStatus, HealthStatusIndicator};
 use nativelink_util::instant_wrapper::InstantWrapper;
 use nativelink_util::retry::{Retrier, RetryResult};
 use nativelink_util::store_trait::{StoreDriver, StoreKey, UploadSizeInfo};
-use rand::rngs::OsRng;
 use rand::Rng;
 use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
 use tokio::net::TcpStream;
@@ -266,7 +265,7 @@ where
             }
             let min = 1. - (jitter_amt / 2.);
             let max = 1. + (jitter_amt / 2.);
-            delay.mul_f32(OsRng.gen_range(min..max))
+            delay.mul_f32(rand::rng().random_range(min..max))
         });
         let s3_client = {
             let http_client =
diff --git a/nativelink-store/tests/ac_utils_test.rs b/nativelink-store/tests/ac_utils_test.rs
index 09b23ba65..7366b3c73 100644
--- a/nativelink-store/tests/ac_utils_test.rs
+++ b/nativelink-store/tests/ac_utils_test.rs
@@ -22,7 +22,7 @@ use nativelink_store::memory_store::MemoryStore;
 use nativelink_util::common::{fs, DigestInfo};
 use nativelink_util::store_trait::{StoreLike, UploadSizeInfo};
 use pretty_assertions::assert_eq;
-use rand::{thread_rng, Rng};
+use rand::Rng;
 use tokio::io::AsyncWriteExt;
 
 /// Get temporary path from either `TEST_TMPDIR` or best effort temp directory if
@@ -31,7 +31,7 @@ async fn make_temp_path(data: &str) -> OsString {
     let dir = format!(
         "{}/{}",
         env::var("TEST_TMPDIR").unwrap_or(env::temp_dir().to_str().unwrap().to_string()),
-        thread_rng().gen::<u64>(),
+        rand::rng().random::<u64>(),
     );
     fs::create_dir_all(&dir).await.unwrap();
     OsString::from(format!("{dir}/{data}"))
diff --git a/nativelink-store/tests/dedup_store_test.rs b/nativelink-store/tests/dedup_store_test.rs
index e8d4d1762..c2c601b99 100644
--- a/nativelink-store/tests/dedup_store_test.rs
+++ b/nativelink-store/tests/dedup_store_test.rs
@@ -75,8 +75,8 @@ async fn simple_round_trip_test() -> Result<(), Error> {
 async fn check_missing_last_chunk_test() -> Result<(), Error> {
     // This is the hash & size of the last chunk item in the content_store.
     const LAST_CHUNK_HASH: &str =
-        "7c8608f5b079bef66c45bd67f7d8ede15d2e1830ea38fd8ad4c6de08b6f21a0c";
-    const LAST_CHUNK_SIZE: usize = 25779;
+        "f6a29384357a77575b0a8cc79f731a4188d0155c00d5fb9a18becd92f6d1f074";
+    const LAST_CHUNK_SIZE: usize = 10669;
 
     let content_store = MemoryStore::new(&MemorySpec::default());
     let store = DedupStore::new(
@@ -281,7 +281,7 @@ async fn has_checks_content_store() -> Result<(), Error> {
     let index_store = MemoryStore::new(&MemorySpec::default());
     let content_store = MemoryStore::new(&MemorySpec {
         eviction_policy: Some(nativelink_config::stores::EvictionPolicy {
-            max_count: 10,
+            max_bytes: DATA_SIZE + 1,
             ..Default::default()
         }),
     });
@@ -306,9 +306,8 @@ async fn has_checks_content_store() -> Result<(), Error> {
         assert_eq!(size_info, Some(DATA_SIZE as u64), "Expected sizes to match");
     }
     {
-        // There will be exactly 10 entries in our content_store based on our random seed data.
-        // If we add one more it will evict a single item from that will still be indexed.
-        // By doing this, we now check that it returns false when we call `.has()`.
+        // We now add one more item to the store, which will trigger eviction of one of
+        // the existing items because max_bytes will be exceeded.
         const DATA2: &str = "1234";
         let digest2 = DigestInfo::try_new(VALID_HASH2, DATA2.len()).unwrap();
         store
diff --git a/nativelink-store/tests/filesystem_store_test.rs b/nativelink-store/tests/filesystem_store_test.rs
index 3f5864744..e32659610 100644
--- a/nativelink-store/tests/filesystem_store_test.rs
+++ b/nativelink-store/tests/filesystem_store_test.rs
@@ -42,7 +42,7 @@ use nativelink_util::store_trait::{Store, StoreKey, StoreLike, UploadSizeInfo};
 use nativelink_util::{background_spawn, spawn};
 use parking_lot::Mutex;
 use pretty_assertions::assert_eq;
-use rand::{thread_rng, Rng};
+use rand::Rng;
 use sha2::{Digest, Sha256};
 use tokio::io::{AsyncReadExt, AsyncSeekExt, AsyncWriteExt, Take};
 use tokio::sync::Barrier;
@@ -192,7 +192,7 @@ fn make_temp_path(data: &str) -> String {
     format!(
         "{}/{}/{}",
         env::var("TEST_TMPDIR").unwrap_or(env::temp_dir().to_str().unwrap().to_string()),
-        thread_rng().gen::<u64>(),
+        rand::rng().random::<u64>(),
         data
     )
 }
diff --git a/nativelink-util/Cargo.toml b/nativelink-util/Cargo.toml
index 953f1004e..3f13755bb 100644
--- a/nativelink-util/Cargo.toml
+++ b/nativelink-util/Cargo.toml
@@ -32,7 +32,7 @@ parking_lot = "0.12.3"
 pin-project-lite = "0.2.16"
 prost = { version = "0.13.4", default-features = false }
 prost-types = { version = "0.13.4", default-features = false }
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 rlimit = { version = "0.10.2", default-features = false }
 serde = { version = "1.0.217", default-features = false }
 sha2 = { version = "0.10.8", default-features = false }
@@ -51,5 +51,5 @@ nativelink-macro = { path = "../nativelink-macro" }
 
 http-body-util = "0.1.2"
 pretty_assertions = { version = "1.4.1", features = ["std"] }
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 serde_json = { version = "1.0.135", default-features = false }
diff --git a/nativelink-util/src/common.rs b/nativelink-util/src/common.rs
index d7325fc6a..bb1139f4c 100644
--- a/nativelink-util/src/common.rs
+++ b/nativelink-util/src/common.rs
@@ -476,3 +476,13 @@ pub fn encode_stream_proto<T: Message>(proto: &T) -> Result<Bytes, Box<dyn std::
 
     Ok(buf.freeze())
 }
+
+/// Small utility to reseed the global RNG.
+/// Done this way because we use it in a macro
+/// and macro's can't load external crates.
+#[inline]
+pub fn reseed_rng_for_test() -> Result<(), Error> {
+    rand::rng()
+        .reseed()
+        .map_err(|e| make_input_err!("Could not reseed RNG - {e:?}"))
+}
diff --git a/nativelink-util/src/origin_event.rs b/nativelink-util/src/origin_event.rs
index df0c1419f..377464495 100644
--- a/nativelink-util/src/origin_event.rs
+++ b/nativelink-util/src/origin_event.rs
@@ -107,9 +107,8 @@ pub fn get_id_for_event(event: &Event) -> [u8; 2] {
 /// Returns a unique node ID for this process.
 pub fn get_node_id(event: Option<&Event>) -> [u8; 6] {
     let mut node_id = *NODE_ID.get_or_init(|| {
-        let mut rng = rand::thread_rng();
         let mut out = [0; 6];
-        rng.fill_bytes(&mut out);
+        rand::rng().fill_bytes(&mut out);
         out
     });
     let Some(event) = event else {
diff --git a/nativelink-util/tests/fastcdc_test.rs b/nativelink-util/tests/fastcdc_test.rs
index 263056368..55d687b9a 100644
--- a/nativelink-util/tests/fastcdc_test.rs
+++ b/nativelink-util/tests/fastcdc_test.rs
@@ -126,7 +126,7 @@ async fn insert_garbage_check_boundaries_recover_test() -> Result<(), std::io::E
     {
         // Replace 2k of bytes and append one byte to middle.
         let mut rng = SmallRng::seed_from_u64(2);
-        rng.fill(&mut rand_data[0..2000]);
+        rng.fill(&mut rand_data[0..4097]);
         rand_data.insert(rand_data.len() / 2, 0x71);
     }
 
@@ -147,15 +147,23 @@ async fn insert_garbage_check_boundaries_recover_test() -> Result<(), std::io::E
     let mut expected_missing_hashes = HashSet::<String>::new();
     {
         expected_missing_hashes
-            .insert("076a696917163caac2725f753bd2be2e902478c59cd92eeff012851da5868800".into());
+            .insert("33e2babb553746787fd56754bfd26f25aa2ccf556930fc0e675915e14487f55b".into());
         expected_missing_hashes
-            .insert("b60ffdcaa8f833ca6a9900814e55d5a47b3205a6ac7d21aaadc64f889b556932".into());
+            .insert("7bae75fcdc38f2e24bfb5853d3494ab10fffd1ad412ef61ae3e876aa370a8065".into());
         expected_missing_hashes
-            .insert("11367bd6ecba2833556decd869ac714180456ab9ef815b167ffae947796377fd".into());
+            .insert("bd71822ebcef1d4dfde53d58afc15423ac02cab3588614ab920876cdf0f8d03b".into());
+        expected_missing_hashes
+            .insert("c0946faf7601cc708db30b31d5eecb14315f6e1339d79fa9da12416ee8841c1b".into());
+        expected_missing_hashes
+            .insert("e6d7c4916345db82a5b368834650c9afb51e519e559537efe107d4f386407af3".into());
 
-        for key in left_frames.keys() {
+        let mut left_keys = left_frames.keys().collect::<Vec<&String>>();
+        left_keys.sort();
+
+        for key in left_keys {
             let maybe_right_frame = right_frames.get(key);
             if maybe_right_frame.is_none() {
+                println!("missing {key}");
                 assert_eq!(
                     expected_missing_hashes.contains(key),
                     true,
@@ -171,18 +179,29 @@ async fn insert_garbage_check_boundaries_recover_test() -> Result<(), std::io::E
     let mut expected_new_hashes = HashMap::<String, usize>::new();
     {
         expected_new_hashes.insert(
-            "867f8da2007726835f89eca1e891c292f648660d0af8cfd169262d13d650fdbd".into(),
+            "57154d1c089eda6418a1e9ab5ca0b929eb0e1e0cd1a35b2907195e33e938554b".into(),
             0,
         );
         expected_new_hashes.insert(
-            "21930b56aa9fd7dca4160be0e4c92f04b883ffda4cdb78704f73eca8b3b98036".into(),
-            1832,
+            "a305c22e712c03c787352f34722d1f223c87f13d4e95253b8a55a6c06a482006".into(),
+            2710,
+        );
+        expected_new_hashes.insert(
+            "58e4340a3957d12042fc968cc955ac1059219b1e38198e7f11dac1bada8b7d3f".into(),
+            4141,
+        );
+        expected_new_hashes.insert(
+            "16df63de6819fc0565dbd1bdd8656c9557bb04639714e86655b562f7218c6e68".into(),
+            5182,
         );
         expected_new_hashes.insert(
-            "0a58dd0fbd1b4942a83d12d3f143ca26cfa2e8b606065298cf37eebde9232a83".into(),
-            49296,
+            "c75449da71b4e1aabfcab7c449602411c3c684e85b66b6c176f1ab2716059b69".into(),
+            49909,
         );
 
+        let mut right_frames = right_frames.into_iter().collect::<Vec<_>>();
+        right_frames.sort_by_key(|(_, (_, pos))| *pos);
+
         for (key, (_, pos)) in right_frames {
             let expected_pos = expected_new_hashes.get(&key);
             assert_eq!(Some(&pos), expected_pos, "For hash {}", key);
diff --git a/nativelink-worker/Cargo.toml b/nativelink-worker/Cargo.toml
index a59aa957c..8b6640abe 100644
--- a/nativelink-worker/Cargo.toml
+++ b/nativelink-worker/Cargo.toml
@@ -38,5 +38,5 @@ hyper = "1.5.2"
 hyper-util = "0.1.10"
 pretty_assertions = { version = "1.4.1", features = ["std"] }
 prost-types = { version = "0.13.4", default-features = false }
-rand = { version = "0.8.5", default-features = false }
+rand = { version = "0.9.0", default-features = false, features = ["thread_rng"] }
 serial_test = { version = "3.2.0", features = ["async"], default-features = false }
diff --git a/nativelink-worker/tests/local_worker_test.rs b/nativelink-worker/tests/local_worker_test.rs
index 8bf0ca8f1..f413a335f 100644
--- a/nativelink-worker/tests/local_worker_test.rs
+++ b/nativelink-worker/tests/local_worker_test.rs
@@ -52,7 +52,7 @@ use nativelink_util::store_trait::Store;
 use nativelink_worker::local_worker::new_local_worker;
 use pretty_assertions::assert_eq;
 use prost::Message;
-use rand::{thread_rng, Rng};
+use rand::Rng;
 use tokio::io::AsyncWriteExt;
 use tonic::Response;
 use utils::local_worker_test_utils::{
@@ -68,7 +68,7 @@ fn make_temp_path(data: &str) -> String {
     format!(
         "{}/{}/{}",
         env::var("TEST_TMPDIR").unwrap_or(env::temp_dir().to_str().unwrap().to_string()),
-        thread_rng().gen::<u64>(),
+        rand::rng().random::<u64>(),
         data
     )
 }
diff --git a/nativelink-worker/tests/running_actions_manager_test.rs b/nativelink-worker/tests/running_actions_manager_test.rs
index 0347ad7b3..3cdf98f8a 100644
--- a/nativelink-worker/tests/running_actions_manager_test.rs
+++ b/nativelink-worker/tests/running_actions_manager_test.rs
@@ -58,7 +58,7 @@ use nativelink_worker::running_actions_manager::{
 };
 use pretty_assertions::assert_eq;
 use prost::Message;
-use rand::{thread_rng, Rng};
+use rand::Rng;
 use serial_test::serial;
 use tokio::sync::oneshot;
 
@@ -69,14 +69,14 @@ fn make_temp_path(data: &str) -> String {
     return format!(
         "{}/{}/{}",
         env::var("TEST_TMPDIR").unwrap_or(env::temp_dir().to_str().unwrap().to_string()),
-        thread_rng().gen::<u64>(),
+        rand::rng().random::<u64>(),
         data
     );
     #[cfg(target_family = "windows")]
     return format!(
         "{}\\{}\\{}",
         env::var("TEST_TMPDIR").unwrap_or(env::temp_dir().to_str().unwrap().to_string()),
-        thread_rng().gen::<u64>(),
+        rand::rng().random::<u64>(),
         data
     );
 }