diff --git a/Cargo.lock b/Cargo.lock
index c8ac1ac..acfbc65 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -934,7 +934,7 @@ dependencies = [
  "serde_json",
  "serde_yaml_ng",
  "serial_test",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "shlex 1.3.0",
  "sqlite-vec",
  "tempfile",
@@ -963,7 +963,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serial_test",
- "sha2 0.10.9",
+ "sha2 0.11.0",
  "tempfile",
  "thiserror 1.0.69",
  "tokio",
diff --git a/crates/clx-core/Cargo.toml b/crates/clx-core/Cargo.toml
index e21eba1..7b72829 100644
--- a/crates/clx-core/Cargo.toml
+++ b/crates/clx-core/Cargo.toml
@@ -37,7 +37,7 @@ toml = { workspace = true }
 
 # Per-project config trust (file-hash allowlist, §3.11). sha2/hex are already
 # in the transitive graph; pin direct versions so we own the API surface.
-sha2 = "0.10"
+sha2 = "0.11"
 hex = "0.4"
 
 # Inter-process advisory file lock for the credential store read-modify-write
diff --git a/crates/clx-hook/Cargo.toml b/crates/clx-hook/Cargo.toml
index 3db6e29..aebc972 100644
--- a/crates/clx-hook/Cargo.toml
+++ b/crates/clx-hook/Cargo.toml
@@ -25,7 +25,7 @@ chrono.workspace = true
 regex.workspace = true
 rusqlite.workspace = true
 toml.workspace = true
-sha2 = "0.10"
+sha2 = "0.11"
 hex = "0.4"
 
 [lints]