diff --git a/Cargo.lock b/Cargo.lock
index f783305..b387438 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -638,15 +638,16 @@ dependencies = [
 
 [[package]]
 name = "blake3"
-version = "1.8.2"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3888aaa89e4b2a40fca9848e400f6a658a5a3978de7be858e209cafa8be9a4a0"
+checksum = "2468ef7d57b3fb7e16b576e8377cdbde2320c60e1491e961d11da40fc4f02a2d"
 dependencies = [
  "arrayref",
  "arrayvec",
  "cc",
  "cfg-if",
- "constant_time_eq 0.3.1",
+ "constant_time_eq 0.4.2",
+ "cpufeatures",
 ]
 
 [[package]]
@@ -1261,9 +1262,9 @@ checksum = "245097e9a4535ee1e3e3931fcfcd55a796a44c643e8596ff6566d68f09b87bbc"
 
 [[package]]
 name = "constant_time_eq"
-version = "0.3.1"
+version = "0.4.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7c74b8349d32d297c9134b8c88677813a227df8f779daa29bfc29c183fe3dca6"
+checksum = "3d52eff69cd5e647efe296129160853a42795992097e8af39800e1060caeea9b"
 
 [[package]]
 name = "convert_case"
diff --git a/Cargo.toml b/Cargo.toml
index 6c3307f..7f7922d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -68,7 +68,7 @@ semver = { version = "^1.0.27" } # 2025-11-03 sw: version range evaluation for d
 serde = { version = "=1.0.228", features = ["derive"] } # 2025-11-03 sw: canonical serialization; CT reviewed
 serde_json = { version = "=1.0.145" } # 2025-11-03 sw: deterministic JSON for protocol surfaces
 serde_yaml = { version = "0.9" } # YAML parsing for CLI policies
-blake3 = { version = "=1.8.2" } # 2025-11-03 sw: convergent hash, SIMD constant-time per upstream audit
+blake3 = { version = "=1.8.3" } # 2025-11-03 sw: convergent hash, SIMD constant-time per upstream audit
 bloomfilter = { version = "=1.0.13" } # 2025-11-03 sw: dedupe candidate screening, bounded memory
 aya = { version = "=0.11.0" } # 2025-11-09 sw: eBPF loader for zero-trust ingress hooks
 tokio-tungstenite = { version = "=0.21.0", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] } # 2025-11-09 sw: mTLS control plane for zero-trust frontends
diff --git a/crates/layout-engine/Cargo.toml b/crates/layout-engine/Cargo.toml
index 2830899..6e2323e 100644
--- a/crates/layout-engine/Cargo.toml
+++ b/crates/layout-engine/Cargo.toml
@@ -15,7 +15,7 @@ pq = ["sha3"]
 
 [dependencies]
 anyhow = "1.0"
-blake3 = "1.5"
+blake3 = "1.8"
 sha3 = { version = "0.10", optional = true }
 tch = { version = "0.15", optional = true, features = ["download-libtorch"] }
 common = { path = "../common" }
diff --git a/crates/web-interface/Cargo.toml b/crates/web-interface/Cargo.toml
index c60ece5..5c3ac92 100644
--- a/crates/web-interface/Cargo.toml
+++ b/crates/web-interface/Cargo.toml
@@ -49,7 +49,7 @@ prometheus.workspace = true
 bytes.workspace = true
 uuid.workspace = true
 hex.workspace = true
-blake3 = "1.5"
+blake3 = "1.8"
 base64 = "0.22"
 
 # Frontend (Leptos)