diff --git a/Cargo.lock b/Cargo.lock
index 7bbd5db..1ae2d36 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -55,6 +55,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "bitflags"
 version = "2.13.0"
@@ -518,7 +524,7 @@ version = "0.1.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "96547c2556ec9d12fb1578c4eaf448b04993e7fb79cbaad930a656880a6bdfa0"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-channel",
  "futures-util",
@@ -975,7 +981,7 @@ version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "bytes",
  "futures-core",
  "futures-util",
@@ -1326,7 +1332,7 @@ name = "tinyagents"
 version = "2.1.1"
 dependencies = [
  "async-trait",
- "base64",
+ "base64 0.23.1",
  "bytes",
  "chrono",
  "chrono-tz",
diff --git a/Cargo.toml b/Cargo.toml
index 088c121..e23ae08 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -82,7 +82,7 @@ chrono-tz = { version = "0.10", optional = true }
 # `STANDARD_NO_PAD`, so `harness::multimodal::data_uri` picks by length instead
 # of trying both — trying both decoded a multi-MB image twice for every
 # unpadded payload.
-base64 = { version = "0.22", optional = true }
+base64 = { version = "0.23", optional = true }
 # `flate2` decompresses `application/gzip` data URIs that carry an
 # `original_mime=` parameter — the shape a renderer emits when it compresses an
 # attachment before handing it over. Decompression is bounded by `Read::take`