diff --git a/Cargo.lock b/Cargo.lock
index d4957cd0..8c5d4119 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1803,7 +1803,7 @@ name = "tinybox-agent37"
 version = "0.2.6"
 dependencies = [
  "async-trait",
- "base64 0.22.1",
+ "base64 0.23.1",
  "reqwest",
  "serde",
  "serde_json",
diff --git a/Cargo.toml b/Cargo.toml
index 4a4bb944..9bfc925a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,7 +60,7 @@ serde_json = "1"
 # The model types are serializable; see `tinybox-core`'s dependency comment.
 serde = { version = "1", features = ["derive"] }
 # Base64 for the agent37 backend's command stdin on the JSON wire.
-base64 = "0.22"
+base64 = "0.23"
 # The agent37 backend is HTTP-native (no CLI), so it owns an HTTP client. rustls
 # avoids a system OpenSSL dependency. See tinybox-agent37's ADR-0008 note.
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }