diff --git a/tools/checksum_updater/Cargo.lock b/tools/checksum_updater/Cargo.lock
index 3438c2d3..486dc76e 100644
--- a/tools/checksum_updater/Cargo.lock
+++ b/tools/checksum_updater/Cargo.lock
@@ -139,9 +139,9 @@ checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "block-buffer"
diff --git a/tools/checksum_updater/Cargo.toml b/tools/checksum_updater/Cargo.toml
index 9026a3b8..ea6d2bc0 100644
--- a/tools/checksum_updater/Cargo.toml
+++ b/tools/checksum_updater/Cargo.toml
@@ -33,7 +33,7 @@ tempfile = "3.24"
 async-trait = "0.1"
 wit-bindgen = "0.52.0"  # WIT binding generation for macro usage (MUST match CLI version in wasm_toolchain.bzl)
 uuid = { version = "1.20", default-features = false }  # UUID generation for user service (deterministic, no getrandom dependency)
-bitflags = "2.6"  # Bitflags for WASI filesystem interfaces in generated bindings
+bitflags = "2.11"  # Bitflags for WASI filesystem interfaces in generated bindings
 
 [dev-dependencies]
 tokio-test = "0.4"