diff --git a/Cargo.toml b/Cargo.toml
index 9e73a5d..96ba46f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -70,7 +70,7 @@ serde_json = { version = "=1.0.145" } # 2025-11-03 sw: deterministic JSON for pr
 serde_yaml = { version = "0.9" } # YAML parsing for CLI policies
 blake3 = { version = "=1.8.2" } # 2025-11-03 sw: convergent hash, SIMD constant-time per upstream audit
 bloomfilter = { version = "=1.0.13" } # 2025-11-03 sw: dedupe candidate screening, bounded memory
-aya = { version = "=0.11.0" } # 2025-11-09 sw: eBPF loader for zero-trust ingress hooks
+aya = { version = "=0.13.1" } # 2025-11-09 sw: eBPF loader for zero-trust ingress hooks
 tokio-tungstenite = { version = "=0.21.0", default-features = false, features = ["connect", "rustls-tls-webpki-roots"] } # 2025-11-09 sw: mTLS control plane for zero-trust frontends
 pqcrypto-mlkem = { version = "=0.1.1" } # 2025-11-09 sw: ML-KEM hybrid wrapping
 reqwest = { version = "=0.11.27", default-features = false, features = ["json", "blocking", "rustls-tls"] } # 2025-11-09 sw: TSA client with rustls backend