diff --git a/crates/Cargo.lock b/crates/Cargo.lock
index 5a53cb201..606ab4c60 100644
--- a/crates/Cargo.lock
+++ b/crates/Cargo.lock
@@ -815,21 +815,15 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.16.1"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 dependencies = [
  "allocator-api2",
  "equivalent",
  "foldhash",
 ]
 
-[[package]]
-name = "hashbrown"
-version = "0.17.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
-
 [[package]]
 name = "http"
 version = "1.4.2"
@@ -1077,7 +1071,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.17.1",
+ "hashbrown",
 ]
 
 [[package]]
@@ -1182,9 +1176,9 @@ dependencies = [
 
 [[package]]
 name = "jsonschema"
-version = "0.46.6"
+version = "0.47.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8374249b1bdce1c1773a09fa294347e19e4bfeb86d845c2d8ebaf8a8dbf11233"
+checksum = "281c43ff06dcb331e9356d30e38853d559ce3d0a3f693e0b0e102667dec14fb1"
 dependencies = [
  "ahash",
  "bytecount",
@@ -1195,18 +1189,27 @@ dependencies = [
  "getrandom 0.3.4",
  "idna",
  "itoa",
+ "jsonschema-regex",
  "num-cmp",
  "num-traits",
  "percent-encoding",
  "referencing",
  "regex",
- "regex-syntax",
  "serde",
  "serde_json",
  "unicode-general-category",
  "uuid-simd",
 ]
 
+[[package]]
+name = "jsonschema-regex"
+version = "0.47.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee0b351864e7ffbc5db9273daf7fa1b4d5177b0946713d667ca571b83c0b4045"
+dependencies = [
+ "regex-syntax",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1637,14 +1640,14 @@ dependencies = [
 
 [[package]]
 name = "referencing"
-version = "0.46.6"
+version = "0.47.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "65a910f9d63351f9c9d7dc3053d02b214ea3a005917140c70087d7b59cbc5bb1"
+checksum = "348e860aeb0b7bd035778fd11dd9cd5290d32e4aed3b8f2274a00287a9fd362b"
 dependencies = [
  "ahash",
  "fluent-uri",
  "getrandom 0.3.4",
- "hashbrown 0.16.1",
+ "hashbrown",
  "itoa",
  "micromap",
  "parking_lot",
diff --git a/crates/runx-contracts/Cargo.toml b/crates/runx-contracts/Cargo.toml
index 4eead4316..314c58d74 100644
--- a/crates/runx-contracts/Cargo.toml
+++ b/crates/runx-contracts/Cargo.toml
@@ -29,7 +29,7 @@ sha2.workspace = true
 runx-contracts-derive.workspace = true
 
 [dev-dependencies]
-jsonschema = { version = "0.46.5", default-features = false }
+jsonschema = { version = "0.47.0", default-features = false }
 serde_json.workspace = true
 
 [[bin]]
diff --git a/crates/runx-receipts/Cargo.toml b/crates/runx-receipts/Cargo.toml
index 222bfd9a8..aa97f1013 100644
--- a/crates/runx-receipts/Cargo.toml
+++ b/crates/runx-receipts/Cargo.toml
@@ -28,7 +28,7 @@ thiserror.workspace = true
 [dev-dependencies]
 base64 = "0.22.1"
 criterion = "0.7.0"
-jsonschema = { version = "0.46.5", default-features = false }
+jsonschema = { version = "0.47.0", default-features = false }
 proptest = { version = "1.11.0", default-features = false, features = ["std"] }
 ring = "0.17.14"
 
diff --git a/crates/runx-runtime/Cargo.toml b/crates/runx-runtime/Cargo.toml
index 352104386..62b30b6b7 100644
--- a/crates/runx-runtime/Cargo.toml
+++ b/crates/runx-runtime/Cargo.toml
@@ -60,7 +60,7 @@ runx-receipts.workspace = true
 # read_limited_response_body), so a decompression bomb stays bounded.
 reqwest = { version = "=0.13.4", default-features = false, features = ["rustls-no-provider", "json", "gzip", "brotli", "deflate", "zstd", "http2"], optional = true }
 ring = "0.17.14"
-jsonschema = { version = "0.46.5", default-features = false }
+jsonschema = { version = "0.47.0", default-features = false }
 # Drive rustls with the ring provider (already linked via `ring`) instead of
 # reqwest's default aws-lc-rs, so the vendored aws-lc-sys C crypto blob is not
 # compiled in. ring is then the single, unambiguous process-default provider.