diff --git a/crates/vibe-profile-store/src/lib.rs b/crates/vibe-profile-store/src/lib.rs
index b2df26d54..e9822b44a 100644
--- a/crates/vibe-profile-store/src/lib.rs
+++ b/crates/vibe-profile-store/src/lib.rs
@@ -69,9 +69,9 @@ fn encrypt(key: &[u8; 32], plaintext: &str) -> Result<Vec<u8>, String> {
     let mut nonce_bytes = [0u8; 12];
     rand::rng().fill(&mut nonce_bytes);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(&nonce_bytes);
+    let nonce = Nonce::from(nonce_bytes);
     let mut ct = cipher
-        .encrypt(nonce, plaintext.as_bytes())
+        .encrypt(&nonce, plaintext.as_bytes())
         .map_err(|e| format!("encrypt: {e}"))?;
     let mut blob = Vec::with_capacity(12 + ct.len());
     blob.extend_from_slice(&nonce_bytes);
@@ -86,9 +86,9 @@ fn decrypt(key: &[u8; 32], blob: &[u8]) -> Result<String, String> {
     }
     let (nonce_bytes, ct) = blob.split_at(12);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(nonce_bytes);
+    let nonce = Nonce::try_from(nonce_bytes).map_err(|_| "bad nonce".to_string())?;
     let pt = cipher
-        .decrypt(nonce, ct)
+        .decrypt(&nonce, ct)
         .map_err(|e| format!("decrypt: {e}"))?;
     String::from_utf8(pt).map_err(|e| format!("utf8: {e}"))
 }
diff --git a/vibecli/vibecli-cli/src/context_assembler.rs b/vibecli/vibecli-cli/src/context_assembler.rs
index 336b2f8e1..cea079e46 100644
--- a/vibecli/vibecli-cli/src/context_assembler.rs
+++ b/vibecli/vibecli-cli/src/context_assembler.rs
@@ -985,7 +985,7 @@ mod tests {
         fs::create_dir_all(src.join("rules")).unwrap();
         fs::write(src.join("rules/r.md"), rule_body).unwrap();
 
-        let key = SigningKey::generate_from_rng(&mut rand::rng());
+        let key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let manifest = crate::plugin_manifest::PluginManifest {
             name: name.to_string(),
             version: "1.0.0".into(),
diff --git a/vibecli/vibecli-cli/src/diff_chain_store.rs b/vibecli/vibecli-cli/src/diff_chain_store.rs
index 474f694aa..25b8cbb57 100644
--- a/vibecli/vibecli-cli/src/diff_chain_store.rs
+++ b/vibecli/vibecli-cli/src/diff_chain_store.rs
@@ -76,9 +76,9 @@ fn encrypt(key: &[u8; 32], plaintext: &[u8]) -> Result<Vec<u8>, String> {
     let mut nonce_bytes = [0u8; 12];
     rand::rng().fill(&mut nonce_bytes);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(&nonce_bytes);
+    let nonce = Nonce::from(nonce_bytes);
     let mut ct = cipher
-        .encrypt(nonce, plaintext)
+        .encrypt(&nonce, plaintext)
         .map_err(|e| format!("encrypt: {e}"))?;
     let mut blob = Vec::with_capacity(12 + ct.len());
     blob.extend_from_slice(&nonce_bytes);
@@ -92,9 +92,9 @@ fn decrypt(key: &[u8; 32], blob: &[u8]) -> Result<Vec<u8>, String> {
     }
     let (nonce_bytes, ct) = blob.split_at(12);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(nonce_bytes);
+    let nonce = Nonce::try_from(nonce_bytes).map_err(|_| "bad nonce".to_string())?;
     cipher
-        .decrypt(nonce, ct)
+        .decrypt(&nonce, ct)
         .map_err(|e| format!("decrypt: {e}"))
 }
 
diff --git a/vibecli/vibecli-cli/src/job_manager.rs b/vibecli/vibecli-cli/src/job_manager.rs
index 9f325c753..3437dc0d7 100644
--- a/vibecli/vibecli-cli/src/job_manager.rs
+++ b/vibecli/vibecli-cli/src/job_manager.rs
@@ -376,7 +376,7 @@ fn encrypt(key: &[u8; 32], plaintext: &str) -> Result<Vec<u8>, String> {
     rand::rng().fill(&mut nonce);
     let cipher = ChaCha20Poly1305::new(key.into());
     let mut ct = cipher
-        .encrypt(Nonce::from_slice(&nonce), plaintext.as_bytes())
+        .encrypt(&Nonce::from(nonce), plaintext.as_bytes())
         .map_err(|e| format!("encrypt: {e}"))?;
     let mut blob = Vec::with_capacity(12 + ct.len());
     blob.extend_from_slice(&nonce);
@@ -390,8 +390,9 @@ fn decrypt(key: &[u8; 32], blob: &[u8]) -> Result<String, String> {
     }
     let (nonce, ct) = blob.split_at(12);
     let cipher = ChaCha20Poly1305::new(key.into());
+    let nonce = Nonce::try_from(nonce).map_err(|_| "bad nonce".to_string())?;
     let pt = cipher
-        .decrypt(Nonce::from_slice(nonce), ct)
+        .decrypt(&nonce, ct)
         .map_err(|e| format!("decrypt: {e}"))?;
     String::from_utf8(pt).map_err(|e| format!("utf8: {e}"))
 }
diff --git a/vibecli/vibecli-cli/src/mcp_governance.rs b/vibecli/vibecli-cli/src/mcp_governance.rs
index 4a1b974cc..3d5969d6f 100644
--- a/vibecli/vibecli-cli/src/mcp_governance.rs
+++ b/vibecli/vibecli-cli/src/mcp_governance.rs
@@ -1168,7 +1168,7 @@ mod tests {
     use p256::elliptic_curve::Generate;
         use tempfile::tempdir;
 
-        let key = SigningKey::generate_from_rng(&mut rand::rng());
+        let key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let manifest = PluginManifest {
             name: plugin_name.into(),
             version: "1.0.0".into(),
diff --git a/vibecli/vibecli-cli/src/plugin_install.rs b/vibecli/vibecli-cli/src/plugin_install.rs
index 3d020504e..e99181f3c 100644
--- a/vibecli/vibecli-cli/src/plugin_install.rs
+++ b/vibecli/vibecli-cli/src/plugin_install.rs
@@ -395,7 +395,7 @@ mod tests {
     }
 
     fn fixture_key() -> SigningKey {
-        SigningKey::generate_from_rng(&mut rand::rng())
+        SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible")
     }
 
     fn fixture_manifest(name: &str, key: &SigningKey, policy: DefaultPolicy) -> PluginManifest {
diff --git a/vibecli/vibecli-cli/src/plugin_runtime.rs b/vibecli/vibecli-cli/src/plugin_runtime.rs
index a05490ce1..622ee6985 100644
--- a/vibecli/vibecli-cli/src/plugin_runtime.rs
+++ b/vibecli/vibecli-cli/src/plugin_runtime.rs
@@ -292,7 +292,7 @@ mod tests {
     }
 
     fn fixture_key() -> SigningKey {
-        SigningKey::generate_from_rng(&mut rand::rng())
+        SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible")
     }
 
     /// Build a signed MCPB bundle with all five component kinds, one
diff --git a/vibecli/vibecli-cli/src/plugin_signing.rs b/vibecli/vibecli-cli/src/plugin_signing.rs
index 3b7b48fee..6fe5c78dd 100644
--- a/vibecli/vibecli-cli/src/plugin_signing.rs
+++ b/vibecli/vibecli-cli/src/plugin_signing.rs
@@ -267,7 +267,7 @@ mod tests {
         // (OS entropy), so it does not qualify; `ThreadRng`'s error is
         // `Infallible`, so it does. p256 0.14 put elliptic-curve on the
         // same rand_core generation as the workspace `rand`.
-        SigningKey::generate_from_rng(&mut rand::rng())
+        SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible")
     }
 
     fn fixture_manifest_with(key: &SigningKey) -> PluginManifest {
diff --git a/vibecli/vibecli-cli/src/session_resume_protocol.rs b/vibecli/vibecli-cli/src/session_resume_protocol.rs
index 6b01484a9..76573c903 100644
--- a/vibecli/vibecli-cli/src/session_resume_protocol.rs
+++ b/vibecli/vibecli-cli/src/session_resume_protocol.rs
@@ -204,7 +204,7 @@ mod tests {
     // signed_agent_card.rs for why the OS RNG does not satisfy the bound.
 
     fn keypair() -> (Vec<u8>, Vec<u8>) {
-        let sk = SigningKey::generate_from_rng(&mut rand::rng());
+        let sk = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let sk_bytes = sk.to_bytes().to_vec();
         let pk_sec1 = sk
             .verifying_key()
diff --git a/vibecli/vibecli-cli/src/signed_agent_card.rs b/vibecli/vibecli-cli/src/signed_agent_card.rs
index cfcbc1303..d99095bc1 100644
--- a/vibecli/vibecli-cli/src/signed_agent_card.rs
+++ b/vibecli/vibecli-cli/src/signed_agent_card.rs
@@ -223,7 +223,7 @@ mod tests {
         // (OS entropy), so it does not qualify; `ThreadRng`'s error is
         // `Infallible`, so it does. p256 0.14 put elliptic-curve on the
         // same rand_core generation as the workspace `rand`.
-        SigningKey::generate_from_rng(&mut rand::rng())
+        SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible")
     }
 
     #[test]
diff --git a/vibecli/vibecli-cli/src/skill_catalog.rs b/vibecli/vibecli-cli/src/skill_catalog.rs
index f71a2b2a7..937c40bec 100644
--- a/vibecli/vibecli-cli/src/skill_catalog.rs
+++ b/vibecli/vibecli-cli/src/skill_catalog.rs
@@ -740,7 +740,7 @@ Just markdown body.
         let store = WorkspaceStore::open_with(&db, [11u8; 32]).unwrap();
 
         // Build + sign a plugin bundle that ships one skill.
-        let key = SigningKey::generate_from_rng(&mut rand::rng());
+        let key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let manifest = PluginManifest {
             name: "demo".into(),
             version: "1.0.0".into(),
@@ -823,6 +823,7 @@ Just markdown body.
         use crate::signed_agent_card::jwk_from_verifying_key;
         use crate::workspace_store::WorkspaceStore;
         use p256::ecdsa::SigningKey;
+        use p256::elliptic_curve::Generate;
 
         let builtin = tempdir().unwrap();
         let ws = tempdir().unwrap();
@@ -830,7 +831,7 @@ Just markdown body.
         std::fs::create_dir_all(db.parent().unwrap()).unwrap();
         let store = WorkspaceStore::open_with(&db, [22u8; 32]).unwrap();
 
-        let key = SigningKey::generate_from_rng(&mut rand::rng());
+        let key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let manifest = PluginManifest {
             name: "muted".into(),
             version: "1.0.0".into(),
@@ -904,6 +905,7 @@ Just markdown body.
         use crate::signed_agent_card::jwk_from_verifying_key;
         use crate::workspace_store::WorkspaceStore;
         use p256::ecdsa::SigningKey;
+        use p256::elliptic_curve::Generate;
 
         let builtin = tempdir().unwrap();
         write_skill(builtin.path(), "agent-loops", SAMPLE_AGENT);
@@ -913,7 +915,7 @@ Just markdown body.
         std::fs::create_dir_all(db.parent().unwrap()).unwrap();
         let store = WorkspaceStore::open_with(&db, [33u8; 32]).unwrap();
 
-        let key = SigningKey::generate_from_rng(&mut rand::rng());
+        let key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let manifest = PluginManifest {
             name: "clash".into(),
             version: "1.0.0".into(),
diff --git a/vibecli/vibecli-cli/src/watch_auth.rs b/vibecli/vibecli-cli/src/watch_auth.rs
index f785740a8..33ce2306a 100644
--- a/vibecli/vibecli-cli/src/watch_auth.rs
+++ b/vibecli/vibecli-cli/src/watch_auth.rs
@@ -907,7 +907,7 @@ mod tests {
         use p256::elliptic_curve::Generate;
 
         // Generate a real P256 keypair
-        let signing_key = SigningKey::generate_from_rng(&mut rand::rng());
+        let signing_key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let verifying_key = signing_key.verifying_key();
 
         // Swift uses: SHA256.hash(data: msg) → sign the hash directly.
@@ -936,7 +936,7 @@ mod tests {
         use p256::ecdsa::{signature::Signer, SigningKey};
         use p256::elliptic_curve::Generate;
 
-        let signing_key = SigningKey::generate_from_rng(&mut rand::rng());
+        let signing_key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let verifying_key = signing_key.verifying_key();
 
         let msg = b"correct message";
@@ -957,8 +957,8 @@ mod tests {
         use p256::ecdsa::{signature::Signer, SigningKey};
         use p256::elliptic_curve::Generate;
 
-        let signing_key = SigningKey::generate_from_rng(&mut rand::rng());
-        let wrong_key = SigningKey::generate_from_rng(&mut rand::rng());
+        let signing_key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
+        let wrong_key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let wrong_verifying = wrong_key.verifying_key();
 
         let msg = b"some message";
@@ -984,7 +984,7 @@ mod tests {
         let ch = mgr.issue_challenge().unwrap();
 
         // Simulate what Swift does: generate key, build message, sign
-        let signing_key = SigningKey::generate_from_rng(&mut rand::rng());
+        let signing_key = SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible");
         let verifying_key = signing_key.verifying_key();
         let device_id = "deadbeef12345678deadbeef12345678";
 
diff --git a/vibecli/vibecli-cli/src/workspace_store.rs b/vibecli/vibecli-cli/src/workspace_store.rs
index 8765ca2ee..0ad8bd3a3 100644
--- a/vibecli/vibecli-cli/src/workspace_store.rs
+++ b/vibecli/vibecli-cli/src/workspace_store.rs
@@ -62,9 +62,9 @@ fn encrypt(key: &[u8; 32], plaintext: &str) -> Result<Vec<u8>, String> {
     let mut nonce_bytes = [0u8; 12];
     rand::rng().fill(&mut nonce_bytes);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(&nonce_bytes);
+    let nonce = Nonce::from(nonce_bytes);
     let mut ct = cipher
-        .encrypt(nonce, plaintext.as_bytes())
+        .encrypt(&nonce, plaintext.as_bytes())
         .map_err(|e| format!("encrypt: {e}"))?;
     let mut blob = Vec::with_capacity(12 + ct.len());
     blob.extend_from_slice(&nonce_bytes);
@@ -78,9 +78,9 @@ fn decrypt(key: &[u8; 32], blob: &[u8]) -> Result<String, String> {
     }
     let (nonce_bytes, ct) = blob.split_at(12);
     let cipher = ChaCha20Poly1305::new(key.into());
-    let nonce = Nonce::from_slice(nonce_bytes);
+    let nonce = Nonce::try_from(nonce_bytes).map_err(|_| "bad nonce".to_string())?;
     let pt = cipher
-        .decrypt(nonce, ct)
+        .decrypt(&nonce, ct)
         .map_err(|e| format!("decrypt: {e}"))?;
     String::from_utf8(pt).map_err(|e| format!("utf8: {e}"))
 }
diff --git a/vibecli/vibecli-cli/tests/watch_p256_auth_bdd.rs b/vibecli/vibecli-cli/tests/watch_p256_auth_bdd.rs
index 422e31af6..47f2d821d 100644
--- a/vibecli/vibecli-cli/tests/watch_p256_auth_bdd.rs
+++ b/vibecli/vibecli-cli/tests/watch_p256_auth_bdd.rs
@@ -54,9 +54,9 @@ fn a_fresh_manager(world: &mut P256World) {
 
 #[given("a P256 signing key is generated")]
 fn generate_p256_key(world: &mut P256World) {
-    world.signing_key = Some(SigningKey::generate_from_rng(
-        &mut rand::rng(),
-    ));
+    world.signing_key = Some(
+        SigningKey::try_generate_from_rng(&mut rand::rng()).expect("ThreadRng is Infallible"),
+    );
 }
 
 #[given("a registration challenge is issued")]
diff --git a/vibecoder/crates/vibe-core/benches/index_bench.rs b/vibecoder/crates/vibe-core/benches/index_bench.rs
index 8a1dfa570..cee73e229 100644
--- a/vibecoder/crates/vibe-core/benches/index_bench.rs
+++ b/vibecoder/crates/vibe-core/benches/index_bench.rs
@@ -3,7 +3,8 @@
 //! Run with: `cargo bench -p vibe-core`
 //! Compile-check only: `cargo bench -p vibe-core --no-run`
 
-use criterion::{black_box, criterion_group, criterion_main, Criterion};
+use criterion::{criterion_group, criterion_main, Criterion};
+use std::hint::black_box;
 use std::path::PathBuf;
 use vibe_core::diff::DiffEngine;
 use vibe_core::index::symbol::extract_symbols;