diff --git a/crates/wx-rust-common/Cargo.toml b/crates/wx-rust-common/Cargo.toml
index c5c04e2..3524326 100644
--- a/crates/wx-rust-common/Cargo.toml
+++ b/crates/wx-rust-common/Cargo.toml
@@ -50,7 +50,7 @@ redis = { workspace = true, optional = true }
 [dev-dependencies]
 criterion = { version = "0.5", features = ["html_reports"] }
 # RSA mitigation 测试：rsa 0.9 依赖 rand_core 0.6（与 workspace rand 0.10 不兼容）
-rand_core = { version = "0.6", features = ["getrandom"] }
+rand_core = { version = "0.10", features = ["getrandom"] }
 
 [[bench]]
 name = "crypto_bench"
diff --git a/crates/wx-rust-cp/Cargo.toml b/crates/wx-rust-cp/Cargo.toml
index e2eb289..455f591 100644
--- a/crates/wx-rust-cp/Cargo.toml
+++ b/crates/wx-rust-cp/Cargo.toml
@@ -35,7 +35,7 @@ rsa = { workspace = true }
 hex = { workspace = true }
 
 [dev-dependencies]
-rand_core = "0.6"
+rand_core = "0.10"
 
 [package.metadata.docs.rs]
 all-features = true
diff --git a/crates/wx-rust-pay/Cargo.toml b/crates/wx-rust-pay/Cargo.toml
index 32c7a97..6b5ed2c 100644
--- a/crates/wx-rust-pay/Cargo.toml
+++ b/crates/wx-rust-pay/Cargo.toml
@@ -53,7 +53,7 @@ x509-cert = "0.2.5"
 # PKCS#12 容器解析：Java KeyStore.getInstance("PKCS12") 的 Rust 等价（纯 Rust；见 WxPayConfig.p12ToPem）
 p12 = "0.6.3"
 # rsa 0.9 的 RNG（rand_core 0.6 系；workspace 的 rand 0.10 与其不兼容），OsRng 用于 RSA 签名盲化/OAEP 加密
-rand_core = { version = "0.6.4", features = ["getrandom"] }
+rand_core = { version = "0.10.1", features = ["getrandom"] }
 # RSA-OAEP 敏感信息加密使用 SHA-1（Java RsaCryptoUtil：RSA/ECB/OAEPWithSHA-1AndMGF1Padding；rsa 0.9 内部 digest 为 0.10 系，workspace sha1 0.11 不适用）
 sha1 = "0.10.6"