diff --git a/Cargo.lock b/Cargo.lock
index 11b430d..4f6b92c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1931,7 +1931,7 @@ dependencies = [
  "rusqlite",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "tempfile",
  "thiserror 2.0.20",
  "tinyagents",
@@ -1961,7 +1961,7 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "tinymemory-api",
  "tinymemory-conformance",
  "tokio",
diff --git a/adapters/remote/Cargo.toml b/adapters/remote/Cargo.toml
index 3f8fcbd..18ec568 100644
--- a/adapters/remote/Cargo.toml
+++ b/adapters/remote/Cargo.toml
@@ -26,7 +26,7 @@ serde = { version = "1", features = ["derive"] }
 futures = "0.3"
 serde_json = "1"
 # Supermemory custom ids are bounded, so namespace/key identities use SHA-256.
-sha2 = "0.10"
+sha2 = "0.11"
 
 [dev-dependencies]
 # The behavioural contract suite, run against these adapters over their own
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 57c8dba..bd00e34 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -65,7 +65,7 @@ tracing = "0.1"
 rusqlite = { version = "=0.40.0", features = ["bundled"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-sha2 = "0.10"
+sha2 = "0.11"
 thiserror = "2.0"
 tokio = { version = "1", features = ["full"] }
 url = "2"