diff --git a/Cargo.lock b/Cargo.lock
index 69560a37743..a7e16b1c062 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1976,7 +1976,7 @@ dependencies = [
  "prometheus",
  "prost",
  "prost-types",
- "rand 0.9.1",
+ "rand 0.9.2",
  "redis",
  "regex",
  "reqwest",
@@ -2165,7 +2165,7 @@ dependencies = [
  "graph-chain-ethereum",
  "graph-runtime-derive",
  "graph-runtime-wasm",
- "rand 0.9.1",
+ "rand 0.9.2",
  "semver",
  "test-store",
  "wasmtime",
@@ -2259,7 +2259,7 @@ dependencies = [
  "postgres",
  "postgres-openssl",
  "pretty_assertions",
- "rand 0.9.1",
+ "rand 0.9.2",
  "serde",
  "serde_json",
  "stable-hash 0.3.4",
@@ -3588,7 +3588,7 @@ dependencies = [
  "parking_lot",
  "percent-encoding",
  "quick-xml",
- "rand 0.9.1",
+ "rand 0.9.2",
  "reqwest",
  "ring",
  "rustls-pemfile",
@@ -3931,7 +3931,7 @@ dependencies = [
  "hmac",
  "md-5",
  "memchr",
- "rand 0.9.1",
+ "rand 0.9.2",
  "sha2",
  "stringprep",
 ]
@@ -4268,9 +4268,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.9.1"
+version = "0.9.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fbfd9d094a40bf3ae768db9361049ace4c0e04a4fd6b359518bd7b73a73dd97"
+checksum = "6db2770f06117d490610c7488547d543617b21bfa07796d7a12f6f1bd53850d1"
 dependencies = [
  "rand_chacha 0.9.0",
  "rand_core 0.9.3",
@@ -5601,7 +5601,7 @@ dependencies = [
  "pin-project-lite",
  "postgres-protocol",
  "postgres-types",
- "rand 0.9.1",
+ "rand 0.9.2",
  "socket2",
  "tokio",
  "tokio-util 0.7.11",
@@ -5972,7 +5972,7 @@ dependencies = [
  "http 1.3.1",
  "httparse",
  "log",
- "rand 0.9.1",
+ "rand 0.9.2",
  "sha1",
  "thiserror 2.0.12",
  "utf-8",
diff --git a/Cargo.toml b/Cargo.toml
index 06b1cd99bef..5753bc51799 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -98,7 +98,7 @@ wasmtime = "33.0.2"
 substreams = "=0.6.0"
 substreams-entity-change = "2"
 substreams-near-core = "=0.10.2"
-rand = { version = "0.9.1", features = ["os_rng"] }
+rand = { version = "0.9.2", features = ["os_rng"] }
 
 # Incremental compilation on Rust 1.58 causes an ICE on build. As soon as graph node builds again, these can be removed.
 [profile.test]