diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index a56068e1be5..1201ebc39a0 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -5358,16 +5358,17 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "9.3.1"
+version = "10.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a87cc7a48537badeae96744432de36f4be2b4a34a05a5ef32e9dd8a1c169dde"
+checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
 dependencies = [
  "base64 0.22.1",
+ "getrandom 0.2.17",
  "js-sys",
  "pem",
- "ring",
  "serde",
  "serde_json",
+ "signature",
  "simple_asn1",
 ]
 
diff --git a/codex-rs/gui/Cargo.toml b/codex-rs/gui/Cargo.toml
index da8f2d5b2db..80ea77de2b7 100644
--- a/codex-rs/gui/Cargo.toml
+++ b/codex-rs/gui/Cargo.toml
@@ -31,7 +31,7 @@ uuid = { version = "1.11", features = ["v4", "serde"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 futures-util = "0.3"
 codex-core = { path = "../core", features = ["custom-features", "git4d-base"] }
-jsonwebtoken = "9.3"
+jsonwebtoken = "10.3"
 sha2 = "0.10"
 sqlx = { version = "0.8", features = [
     "runtime-tokio-rustls",
diff --git a/codex-rs/orchestrator/Cargo.toml b/codex-rs/orchestrator/Cargo.toml
index 7e25b5b5f3a..3a5d52e004a 100644
--- a/codex-rs/orchestrator/Cargo.toml
+++ b/codex-rs/orchestrator/Cargo.toml
@@ -23,7 +23,7 @@ sha2 = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
 tracing = { workspace = true }
-jsonwebtoken = "9.3"
+jsonwebtoken = "10.3"
 ring = "0.17"
 regex = "1.10"
 toml = "0.8"