diff --git a/Cargo.lock b/Cargo.lock
index da16e0b..606bb5f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -286,6 +286,12 @@ version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "chacha20"
 version = "0.10.2"
@@ -1103,6 +1109,18 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "743fb55ba31b18fb1ecef6bdc9aa2743314978ac084044301a7eee33fb99a20d"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nom"
 version = "8.0.0"
@@ -1842,7 +1860,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -1967,7 +1985,7 @@ dependencies = [
  "quick-xml 0.41.0",
  "serde_json",
  "tinydocs-bus",
- "zip 8.6.0",
+ "zip 9.0.1",
 ]
 
 [[package]]
@@ -1994,7 +2012,7 @@ dependencies = [
  "tinydocs",
  "tinydocs-bus",
  "tokio",
- "zip 8.6.0",
+ "zip 9.0.1",
 ]
 
 [[package]]
@@ -2587,6 +2605,21 @@ dependencies = [
  "zopfli",
 ]
 
+[[package]]
+name = "zip"
+version = "9.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e49ade69c4434c55dd651d36fe05f38e0578db948b773cbc01c48c4b5e560692"
+dependencies = [
+ "crc32fast",
+ "flate2",
+ "indexmap",
+ "memchr",
+ "nix",
+ "typed-path",
+ "zopfli",
+]
+
 [[package]]
 name = "zlib-rs"
 version = "0.6.8"
diff --git a/Cargo.toml b/Cargo.toml
index 9846f17..721b4f5 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,7 +60,7 @@ ppt-rs = { version = "0.2", optional = true }
 pdf-extract = { version = "0.12", optional = true }
 
 # Bounded OOXML intake reads only selected XML parts, never extracts files.
-zip = { version = "8", default-features = false, features = ["deflate"], optional = true }
+zip = { version = "9", default-features = false, features = ["deflate"], optional = true }
 # Streaming XML events avoid building attacker-controlled DOM trees.
 quick-xml = { version = "0.41", optional = true }
 # Workbook row conversion for document-memory Markdown; implementation only.
@@ -73,7 +73,7 @@ hayro = { version = "0.5", optional = true }
 png = "0.17"
 # `.docx` output is a zip container; the tests re-open the produced bytes and
 # assert on the OOXML parts inside.
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 # The spec types are a JSON wire contract; the tests assert they round-trip and
 # that unknown keys are rejected.
 serde_json = "1"
diff --git a/crates/tinydocs-module/Cargo.toml b/crates/tinydocs-module/Cargo.toml
index 6daee69..db36db0 100644
--- a/crates/tinydocs-module/Cargo.toml
+++ b/crates/tinydocs-module/Cargo.toml
@@ -52,6 +52,6 @@ base64 = "0.23"
 # document directly rather than depending on the module's own wire types, so a
 # rename here would be caught as a contract change.
 serde_json = "1"
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 # Enable TinyBus loader helpers only in test builds, not downstream production builds.
 tinybus = { version = ">=0.1.3, <0.2", default-features = false, features = ["test-support"] }