diff --git a/Cargo.lock b/Cargo.lock
index 8e00c67..2b8387b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -900,7 +900,7 @@ name = "devstack-hub"
 version = "0.33.0"
 dependencies = [
  "axum",
- "base64 0.22.1",
+ "base64 0.23.1",
  "blake3",
  "bytes",
  "devstack-compose",
diff --git a/Cargo.toml b/Cargo.toml
index 51d37ba..2273663 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -91,7 +91,7 @@ time = "0.3"
 x509-parser = "0.18"
 sha2 = "0.11"
 # PKCE for the hub's OAuth login of MCP upstreams (ADR-0069).
-base64 = "0.22"
+base64 = "0.23"
 zip = { version = "9", default-features = false, features = ["deflate"] }
 flate2 = "1"
 tar = "0.4"