diff --git a/Cargo.lock b/Cargo.lock
index 1d90b51a7..c553428d7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2002,9 +2002,9 @@ dependencies = [
 
 [[package]]
 name = "password-hash"
-version = "0.4.2"
+version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7676374caaee8a325c9e7a2ae557f216c5563a171d6997b0ef8a65af35147700"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
 dependencies = [
  "base64ct",
  "rand_core",
@@ -2013,14 +2013,13 @@ dependencies = [
 
 [[package]]
 name = "pbkdf2"
-version = "0.11.0"
+version = "0.12.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83a0692ec44e4cf1ef28ca317f14f8f07da2d95ec3fa01f86e4467b725e60917"
+checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
 dependencies = [
  "digest",
  "hmac",
  "password-hash",
- "sha2",
 ]
 
 [[package]]
diff --git a/crates/xline-client/Cargo.toml b/crates/xline-client/Cargo.toml
index 0eef5cf38..eb6aef04f 100644
--- a/crates/xline-client/Cargo.toml
+++ b/crates/xline-client/Cargo.toml
@@ -17,7 +17,7 @@ curp = { path = "../curp" }
 futures = "0.3.25"
 getrandom = "0.2"
 http = "0.2.9"
-pbkdf2 = { version = "0.11.0", features = ["std"] }
+pbkdf2 = { version = "0.12.2", features = ["std"] }
 thiserror = "1.0.37"
 tokio = { version = "0.2.23", package = "madsim-tokio", features = ["sync"] }
 tonic = { version = "0.4.1", package = "madsim-tonic" }
diff --git a/crates/xline/Cargo.toml b/crates/xline/Cargo.toml
index 90d1a2536..dcd32993a 100644
--- a/crates/xline/Cargo.toml
+++ b/crates/xline/Cargo.toml
@@ -46,7 +46,7 @@ opentelemetry-otlp = { version = "0.14.0", features = [
 opentelemetry-prometheus = { version = "0.14.1" }
 opentelemetry_sdk = { version = "0.21.0", features = ["metrics", "rt-tokio"] }
 parking_lot = "0.12.0"
-pbkdf2 = { version = "0.11.0", features = ["std"] }
+pbkdf2 = { version = "0.12.2", features = ["std"] }
 priority-queue = "1.3.0"
 prometheus = "0.13.3"
 prost = "0.12.3"