diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index 0b3b4f8df..1e58ccac6 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -1909,7 +1909,7 @@ dependencies = [
  "http 1.4.0",
  "jsonwebtoken",
  "pretty_assertions",
- "rand 0.9.3",
+ "rand 0.10.1",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -2216,7 +2216,7 @@ dependencies = [
  "jsonwebtoken",
  "owo-colors",
  "pretty_assertions",
- "rand 0.9.3",
+ "rand 0.10.1",
  "serde",
  "serde_json",
  "sha2 0.10.9",
@@ -2462,7 +2462,7 @@ dependencies = [
  "eventsource-stream",
  "futures",
  "http 1.4.0",
- "rand 0.9.3",
+ "rand 0.10.1",
  "tokio",
  "tracing",
 ]
@@ -2829,7 +2829,7 @@ dependencies = [
  "opentelemetry_sdk",
  "predicates",
  "pretty_assertions",
- "rand 0.9.3",
+ "rand 0.10.1",
  "regex-lite",
  "rmcp",
  "serde",
@@ -3515,7 +3515,7 @@ dependencies = [
  "once_cell",
  "os_info",
  "pretty_assertions",
- "rand 0.9.3",
+ "rand 0.10.1",
  "regex-lite",
  "serde",
  "serde_json",
@@ -3799,7 +3799,7 @@ dependencies = [
  "rama-tcp",
  "rama-tls-rustls",
  "rama-unix",
- "rand 0.9.3",
+ "rand 0.10.1",
  "rustls-native-certs",
  "schannel",
  "security-framework 3.5.1",
@@ -4116,7 +4116,7 @@ dependencies = [
  "codex-keyring-store",
  "keyring",
  "pretty_assertions",
- "rand 0.9.3",
+ "rand 0.10.1",
  "regex",
  "schemars 0.8.22",
  "serde",
@@ -4412,7 +4412,7 @@ dependencies = [
  "pathdiff",
  "pretty_assertions",
  "pulldown-cmark",
- "rand 0.9.3",
+ "rand 0.10.1",
  "ratatui",
  "ratatui-macros",
  "regex-lite",
@@ -7869,7 +7869,7 @@ dependencies = [
  "idna",
  "ipnet",
  "once_cell",
- "rand 0.9.3",
+ "rand 0.9.5",
  "ring",
  "thiserror 2.0.18",
  "tinyvec",
@@ -7891,7 +7891,7 @@ dependencies = [
  "moka",
  "once_cell",
  "parking_lot",
- "rand 0.9.3",
+ "rand 0.9.5",
  "resolv-conf",
  "smallvec",
  "thiserror 2.0.18",
@@ -10111,7 +10111,7 @@ dependencies = [
  "futures-util",
  "opentelemetry",
  "percent-encoding",
- "rand 0.9.3",
+ "rand 0.9.5",
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
@@ -10782,7 +10782,7 @@ checksum = "bee689443a2bd0a16ab0348b52ee43e3b2d1b1f931c8aa5c9f8de4c86fbe8c40"
 dependencies = [
  "bitflags 2.13.1",
  "num-traits",
- "rand 0.9.3",
+ "rand 0.9.5",
  "rand_chacha 0.9.0",
  "rand_xorshift",
  "regex-syntax",
@@ -11014,7 +11014,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand 0.9.3",
+ "rand 0.9.5",
  "ring",
  "rustc-hash 2.1.1",
  "rustls",
@@ -11152,7 +11152,7 @@ dependencies = [
  "rama-http-types",
  "rama-net",
  "rama-utils",
- "rand 0.9.3",
+ "rand 0.9.5",
  "serde",
  "serde_html_form",
  "serde_json",
@@ -11222,7 +11222,7 @@ dependencies = [
  "rama-macros",
  "rama-net",
  "rama-utils",
- "rand 0.9.3",
+ "rand 0.9.5",
  "serde",
  "sha1 0.10.6",
 ]
@@ -11250,7 +11250,7 @@ dependencies = [
  "rama-error",
  "rama-macros",
  "rama-utils",
- "rand 0.9.3",
+ "rand 0.9.5",
  "serde",
  "serde_json",
  "sync_wrapper",
@@ -11324,7 +11324,7 @@ dependencies = [
  "rama-http-types",
  "rama-net",
  "rama-utils",
- "rand 0.9.3",
+ "rand 0.9.5",
  "tokio",
 ]
 
@@ -11404,9 +11404,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.3"
+version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ec095654a25171c2124e9e3393a930bddbffdc939556c914957a4c3e0a87166"
+checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.5",
@@ -12430,7 +12430,7 @@ version = "0.46.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26ab054c34b87f96c3e4701bea1888317cde30cc7e4a6136d2c48454ab96661c"
 dependencies = [
- "rand 0.9.3",
+ "rand 0.9.5",
  "sentry-types",
  "serde",
  "serde_json",
@@ -12478,7 +12478,7 @@ checksum = "eecbd63e9d15a26a40675ed180d376fcb434635d2e33de1c24003f61e3e2230d"
 dependencies = [
  "debugid",
  "hex",
- "rand 0.9.3",
+ "rand 0.9.5",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -14585,7 +14585,7 @@ dependencies = [
  "http 1.4.0",
  "httparse",
  "log",
- "rand 0.9.3",
+ "rand 0.9.5",
  "rustls",
  "rustls-pki-types",
  "sha1 0.10.6",
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index 1a43d6c14..5fbea2672 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -382,7 +382,7 @@ predicates = "3"
 pretty_assertions = "1.4.1"
 pulldown-cmark = { version = "0.10", default-features = false }
 quick-xml = "0.41.0"
-rand = "0.9"
+rand = "0.10"
 ratatui = { version = "0.30.2", default-features = false, features = [
     "crossterm",
     "layout-cache",