diff --git a/Cargo.lock b/Cargo.lock
index 5df2bf2f6b..7258546d34 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -692,11 +692,11 @@ checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"
 [[package]]
 name = "cbor-codec"
 version = "0.7.1"
-source = "git+https://github.com/wireapp/proteus?tag=v2.1.1#b92dbc2d0c77105cae3911a7388acba05450a06d"
+source = "git+https://github.com/wireapp/proteus?tag=v2.1.2#0d9a2f80f0e0a71ffdd57f1924bad71e2ec52001"
 dependencies = [
  "byteorder",
  "half",
- "rand 0.8.5",
+ "rand 0.9.2",
 ]
 
 [[package]]
@@ -1061,7 +1061,7 @@ dependencies = [
  "pem",
  "proteus-traits",
  "proteus-wasm",
- "rand 0.8.5",
+ "rand 0.9.2",
  "rmp-serde",
  "rstest",
  "rstest_reuse",
@@ -1101,7 +1101,7 @@ dependencies = [
  "core-crypto-macros",
  "derive_more",
  "futures-util",
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
  "hex",
  "js-sys",
  "log",
@@ -1138,7 +1138,7 @@ dependencies = [
  "derive_more",
  "env_logger",
  "futures-lite",
- "getrandom 0.2.15",
+ "getrandom 0.3.4",
  "hex",
  "idb",
  "itertools 0.14.0",
@@ -1154,7 +1154,7 @@ dependencies = [
  "postcard",
  "proteus-traits",
  "proteus-wasm",
- "rand 0.8.5",
+ "rand 0.9.2",
  "refinery",
  "rstest",
  "rstest_reuse",
@@ -2174,21 +2174,21 @@ dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.3.2"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73fea8450eea4bac3940448fb7ae50d91f034f941199fcd9d909a5a07aa455f0"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
  "r-efi",
- "wasi 0.14.2+wasi-0.2.4",
+ "wasip2",
  "wasm-bindgen",
 ]
 
@@ -2393,9 +2393,9 @@ dependencies = [
 
 [[package]]
 name = "hpke"
-version = "0.12.0"
+version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4917627a14198c3603282c5158b815ad5534795451d3c074b53cf3cee0960b11"
+checksum = "f65d16b699dd1a1fa2d851c970b0c971b388eeeb40f744252b8de48860980c8f"
 dependencies = [
  "aead",
  "aes-gcm",
@@ -2407,7 +2407,7 @@ dependencies = [
  "p256",
  "p384",
  "p521",
- "rand_core 0.6.4",
+ "rand_core 0.9.3",
  "sha2",
  "subtle",
  "x25519-dalek",
@@ -2885,7 +2885,7 @@ dependencies = [
  "mls-crypto-provider",
  "openmls",
  "proteus-wasm",
- "rand 0.8.5",
+ "rand 0.9.2",
  "serde",
  "serde_json",
  "sha2",
@@ -3330,7 +3330,7 @@ checksum = "80e04d1dcff3aae0704555fe5fee3bcfaf3d1fdf8a7e521d5b9d2b42acb52cec"
 dependencies = [
  "hermit-abi 0.3.9",
  "libc",
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
  "windows-sys 0.52.0",
 ]
 
@@ -3345,7 +3345,7 @@ dependencies = [
  "core-crypto-keystore",
  "ecdsa",
  "ed25519-dalek",
- "getrandom 0.2.15",
+ "getrandom 0.3.4",
  "hex",
  "hex-literal",
  "hkdf",
@@ -3357,9 +3357,8 @@ dependencies = [
  "p256",
  "p384",
  "p521",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
  "rstest",
  "rstest_reuse",
  "sha1",
@@ -3647,7 +3646,7 @@ dependencies = [
  "log",
  "openmls",
  "openmls_basic_credential",
- "rand 0.8.5",
+ "rand 0.9.2",
  "sha2",
 ]
 
@@ -4416,7 +4415,7 @@ dependencies = [
 [[package]]
 name = "proteus-traits"
 version = "2.1.0"
-source = "git+https://github.com/wireapp/proteus?tag=v2.1.1#b92dbc2d0c77105cae3911a7388acba05450a06d"
+source = "git+https://github.com/wireapp/proteus?tag=v2.1.2#0d9a2f80f0e0a71ffdd57f1924bad71e2ec52001"
 dependencies = [
  "async-trait",
 ]
@@ -4424,7 +4423,7 @@ dependencies = [
 [[package]]
 name = "proteus-wasm"
 version = "2.1.0"
-source = "git+https://github.com/wireapp/proteus?tag=v2.1.1#b92dbc2d0c77105cae3911a7388acba05450a06d"
+source = "git+https://github.com/wireapp/proteus?tag=v2.1.2#0d9a2f80f0e0a71ffdd57f1924bad71e2ec52001"
 dependencies = [
  "cbor-codec",
  "chacha20",
@@ -4432,14 +4431,13 @@ dependencies = [
  "ed25519-dalek",
  "eyre",
  "generic-array",
- "getrandom 0.2.15",
+ "getrandom 0.3.4",
  "hex",
  "hkdf",
  "hmac",
  "proteus-traits",
- "rand 0.8.5",
- "rand_chacha 0.3.1",
- "rand_core 0.6.4",
+ "rand 0.9.2",
+ "rand_chacha 0.9.0",
  "serde",
  "sha2",
  "subtle",
@@ -4535,7 +4533,7 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "99d9a13982dcf210057a8a78572b2217b667c3beacbf3a0d8b454f6f82837d38"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
 ]
 
 [[package]]
@@ -5854,7 +5852,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
 dependencies = [
  "fastrand",
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix 1.1.3",
  "windows-sys 0.61.2",
@@ -6603,7 +6601,7 @@ version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee48d38b119b0cd71fe4141b30f5ba9c7c5d9f4e7a3a8b4a674e4b6ef789976f"
 dependencies = [
- "getrandom 0.3.2",
+ "getrandom 0.3.4",
  "js-sys",
  "sha1_smol",
  "wasm-bindgen",
@@ -6752,12 +6750,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
-name = "wasi"
-version = "0.14.2+wasi-0.2.4"
+name = "wasip2"
+version = "1.0.2+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9683f9a5a998d873c0d21fcbe3c083009670149a8fab228644b8bd36b2c48cb3"
+checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
 dependencies = [
- "wit-bindgen-rt",
+ "wit-bindgen",
 ]
 
 [[package]]
@@ -6766,7 +6764,7 @@ version = "0.12.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c1fbb4ef9bbca0c1170e0b00dd28abc9e3b68669821600cad1caaed606583c6d"
 dependencies = [
- "wasi 0.11.0+wasi-snapshot-preview1",
+ "wasi",
 ]
 
 [[package]]
@@ -7409,7 +7407,7 @@ dependencies = [
  "ed25519-dalek",
  "env_logger",
  "flagset",
- "getrandom 0.2.15",
+ "getrandom 0.3.4",
  "hex",
  "html_parser",
  "http 1.4.0",
@@ -7429,7 +7427,7 @@ dependencies = [
  "p521",
  "password-hash",
  "pem",
- "rand 0.8.5",
+ "rand 0.9.2",
  "reqwest",
  "rstest",
  "rusty-jwt-tools",
@@ -7453,13 +7451,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "wit-bindgen-rt"
-version = "0.39.0"
+name = "wit-bindgen"
+version = "0.51.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f42320e61fe2cfd34354ecb597f86f413484a798ba44a8ca1165c58d42da6c1"
-dependencies = [
- "bitflags",
-]
+checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
 
 [[package]]
 name = "with_builtin_macros"
diff --git a/Cargo.toml b/Cargo.toml
index e444315f09..60797b1529 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -58,7 +58,7 @@ macro_rules_attribute = "0.2"
 mls-crypto-provider = { path = "mls-provider" }
 obfuscate = { path = "obfuscate" }
 pem = "3.0"
-rand = { version = "0.8", features = ["getrandom"] }
+rand = { version = "0.9", features = ["os_rng"] }
 rmp-serde = "1.3.1"
 schnellru = "0.2"
 serde = "1.0"
@@ -85,7 +85,7 @@ der = { version = "0.7", default-features = false, features = ["std"] }
 ecdsa = { version = "0.16", default-features = false }
 ed25519-dalek = { version = "2.2", default-features = false }
 flagset = { version = "0.4", default-features = false }
-getrandom = { version = "0.2.8", default-features = false }
+getrandom = { version = "0.3.4", default-features = false }
 jwt-simple = { version = "0.13", git = "https://github.com/wireapp/rust-jwt-simple", tag = "v0.13.0-pre.core-crypto-1.0.0", default-features = false }
 p256 = { version = "0.13", default-features = false }
 p384 = { version = "0.13", default-features = false }
@@ -122,8 +122,8 @@ openmls_traits = { git = "https://github.com/wireapp/openmls", rev = "c9cde17076
 openmls_x509_credential = { git = "https://github.com/wireapp/openmls", rev = "c9cde17076508968c9cbead5728454f0a1f60c4f", version = "0.2" }
 
 # proteus
-proteus-traits = { git = "https://github.com/wireapp/proteus", tag = "v2.1.1" }
-proteus-wasm = { git = "https://github.com/wireapp/proteus", tag = "v2.1.1" }
+proteus-traits = { git = "https://github.com/wireapp/proteus", tag = "v2.1.2" }
+proteus-wasm = { git = "https://github.com/wireapp/proteus", tag = "v2.1.2" }
 
 [profile.release]
 codegen-units = 1
diff --git a/e2e-identity/Cargo.toml b/e2e-identity/Cargo.toml
index 11f0543c85..fefd8fb7ca 100644
--- a/e2e-identity/Cargo.toml
+++ b/e2e-identity/Cargo.toml
@@ -38,7 +38,7 @@ p256 = { workspace = true }
 p384 = { workspace = true }
 p521 = { workspace = true }
 pem = { workspace = true }
-getrandom = { workspace = true, features = ["js"] }
+getrandom = { workspace = true, features = ["wasm_js"] }
 web-time = { workspace = true }
 hex = { workspace = true }
 flagset = { workspace = true }
diff --git a/e2e-identity/tests/utils/idp/authelia/mod.rs b/e2e-identity/tests/utils/idp/authelia/mod.rs
index c9b3447907..a48193c525 100644
--- a/e2e-identity/tests/utils/idp/authelia/mod.rs
+++ b/e2e-identity/tests/utils/idp/authelia/mod.rs
@@ -2,7 +2,7 @@ use std::net::SocketAddr;
 
 use argon2::{
     Algorithm, Argon2, ParamsBuilder, Version,
-    password_hash::{PasswordHasher, SaltString, rand_core::OsRng},
+    password_hash::{PasswordHasher, SaltString},
 };
 use http::header;
 use oauth2::{CsrfToken, PkceCodeChallenge, RedirectUrl, Scope};
diff --git a/keystore/Cargo.toml b/keystore/Cargo.toml
index 1b35c326e6..173bd76af4 100644
--- a/keystore/Cargo.toml
+++ b/keystore/Cargo.toml
@@ -33,8 +33,8 @@ postcard = { version = "1.1", default-features = false, features = ["use-std"] }
 sha2.workspace = true
 serde_json.workspace = true
 core-crypto-macros.workspace = true
-rand = { workspace = true, features = ["getrandom"] }
-getrandom = { version = "0.2", features = ["js"] }
+rand = { workspace = true, features = ["os_rng"] }
+getrandom = { version = "0.3", features = ["wasm_js"] }
 obfuscate = { workspace = true, features = ["openmls"] }
 openmls = { workspace = true }
 x509-cert = { workspace = true }
diff --git a/mls-provider/Cargo.toml b/mls-provider/Cargo.toml
index f11f8e7ef3..23ea04b292 100644
--- a/mls-provider/Cargo.toml
+++ b/mls-provider/Cargo.toml
@@ -34,10 +34,9 @@ spki = { version = "0.7", features = ["pem", "fingerprint"] }
 x509-cert = { workspace = true, features = ["builder", "hazmat"] }
 wire-e2e-identity = { workspace = true }
 web-time = "1.1.0"
-rand = { workspace = true, features = ["getrandom"] }
-getrandom = { version = "0.2", features = ["js"] }
-rand_core = "0.6"
-rand_chacha = "0.3"
+rand = { workspace = true, features = ["os_rng"] }
+getrandom = { version = "0.3", features = ["wasm_js"] }
+rand_chacha = "0.9"
 zeroize.workspace = true
 thiserror.workspace = true
 hex.workspace = true
@@ -46,7 +45,7 @@ core-crypto-keystore.workspace = true
 typed-builder.workspace = true
 
 [dependencies.hpke]
-version = "0.12"
+version = "0.13"
 features = ["x25519", "p256", "p384", "p521"]
 
 [dev-dependencies]
diff --git a/mls-provider/src/crypto_provider.rs b/mls-provider/src/crypto_provider.rs
index 137f0ee1d6..38fed55842 100644
--- a/mls-provider/src/crypto_provider.rs
+++ b/mls-provider/src/crypto_provider.rs
@@ -14,7 +14,7 @@ use openmls_traits::{
         HpkeKemType, SignatureScheme,
     },
 };
-use rand_core::{RngCore, SeedableRng};
+use rand::{SeedableRng as _, TryRngCore as _};
 use sha2::{Digest, Sha256, Sha384, Sha512};
 use signature::digest::typenum::Unsigned;
 use tls_codec::SecretVLBytes;
@@ -29,7 +29,7 @@ pub struct RustCrypto {
 impl Default for RustCrypto {
     fn default() -> Self {
         Self {
-            rng: Arc::new(rand_chacha::ChaCha20Rng::from_entropy().into()),
+            rng: Arc::new(rand_chacha::ChaCha20Rng::from_os_rng().into()),
         }
     }
 }
@@ -617,7 +617,7 @@ mod hpke_core {
         info: &[u8],
         aad: &[u8],
         plaintext: &[u8],
-        csprng: &mut impl rand_core::CryptoRngCore,
+        csprng: &mut impl rand::CryptoRng,
     ) -> Result<HpkeCiphertext, CryptoError> {
         use hpke::{Deserializable as _, Serializable as _};
         let key = Kem::PublicKey::from_bytes(public_key).map_err(|_| CryptoError::HpkeEncryptionError)?;
@@ -633,7 +633,7 @@ mod hpke_core {
 
     #[allow(dead_code)]
     pub(crate) fn hpke_gen_keypair<Kem: hpke::Kem>(
-        csprng: &mut impl rand_core::CryptoRngCore,
+        csprng: &mut impl rand::CryptoRng,
     ) -> Result<HpkeKeyPair, CryptoError> {
         use hpke::Serializable as _;
         let (sk, pk) = Kem::gen_keypair(csprng);
@@ -676,7 +676,7 @@ mod hpke_core {
         info: &[u8],
         export_info: &[u8],
         export_len: usize,
-        csprng: &mut impl rand_core::CryptoRngCore,
+        csprng: &mut impl rand::CryptoRng,
     ) -> Result<(Vec<u8>, Vec<u8>), CryptoError> {
         use hpke::{Deserializable as _, Serializable as _};
         let key = Kem::PublicKey::from_bytes(tx_public_key).map_err(|_| CryptoError::SenderSetupError)?;
diff --git a/mls-provider/src/lib.rs b/mls-provider/src/lib.rs
index 03acb2286c..6ad1c1e80f 100644
--- a/mls-provider/src/lib.rs
+++ b/mls-provider/src/lib.rs
@@ -17,10 +17,6 @@ use openmls_traits::{
 };
 pub use pki::{CertProfile, CertificateGenerationArgs, PkiEnvironmentProvider, PkiKeypair};
 
-pub mod reexports {
-    pub use rand_core;
-}
-
 /// 32-byte raw entropy seed
 pub type RawEntropySeed = <rand_chacha::ChaCha20Rng as rand::SeedableRng>::Seed;
 
diff --git a/obfuscate/src/lib.rs b/obfuscate/src/lib.rs
index 6676376526..95c8ad0dc1 100644
--- a/obfuscate/src/lib.rs
+++ b/obfuscate/src/lib.rs
@@ -18,7 +18,7 @@ pub fn compute_hash(bytes: &[u8]) -> [u8; 10] {
     static SALT: LazyLock<[u8; 32]> = LazyLock::new(|| {
         use rand::Rng as _;
         let mut salt = [0; _];
-        rand::thread_rng().fill(&mut salt);
+        rand::rng().fill(&mut salt);
         salt
     });