diff --git a/Cargo.lock b/Cargo.lock
index 542b333..c277dab 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1633,7 +1633,7 @@ dependencies = [
 name = "tinydocs-module"
 version = "0.1.13"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "getrandom 0.3.4",
  "serde",
  "serde_json",
diff --git a/crates/tinydocs-module/Cargo.toml b/crates/tinydocs-module/Cargo.toml
index ca2d47b..a384d52 100644
--- a/crates/tinydocs-module/Cargo.toml
+++ b/crates/tinydocs-module/Cargo.toml
@@ -22,7 +22,7 @@ tinybus-module = { version = "0.1.0", path = "../../vendor/tinybus/crates/tinybu
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 # Bus frames are JSON, where a byte array costs ~3.5 bytes per byte. Chunks are
 # base64 (1.34x) so a 4 MiB chunk fits a frame with room to spare.
-base64 = "0.22"
+base64 = "0.23"
 # Chunked transfer verifies each assembled blob against a caller-declared digest
 # before it becomes readable, so a truncated upload cannot be consumed as whole.
 sha2 = "0.10"
@@ -41,7 +41,7 @@ workspace = true
 
 [dev-dependencies]
 # The loader E2E test speaks the base64 transfer surface the same way a host does.
-base64 = "0.22"
+base64 = "0.23"
 # `GeneratePptx` takes a deck whose images name staged blobs; the test builds that
 # document directly rather than depending on the module's own wire types, so a
 # rename here would be caught as a contract change.