diff --git a/Cargo.lock b/Cargo.lock
index 67bbe71..156f69a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1693,7 +1693,7 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tower",
- "tower-http",
+ "tower-http 0.7.1",
  "url",
  "uuid",
 ]
@@ -2361,7 +2361,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tower",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -3342,6 +3342,21 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "tower-http"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
+dependencies = [
+ "bitflags 2.13.1",
+ "bytes",
+ "http",
+ "percent-encoding",
+ "pin-project-lite",
+ "tower-layer",
+ "tower-service",
+]
+
 [[package]]
 name = "tower-layer"
 version = "0.3.3"
diff --git a/Cargo.toml b/Cargo.toml
index b6055be..64551a1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -60,7 +60,7 @@ chrono = { version = "0.4", features = ["serde"] }
 # HTTP client used by the TinyFlows webhook adapter.
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 # CORS middleware allows the local Vite dashboard to call the Axum API.
-tower-http = { version = "0.6", features = ["cors"] }
+tower-http = { version = "0.7", features = ["cors"] }
 # Native ClickHouse client used for immutable engagement analytics events.
 clickhouse = { version = "0.13", features = ["chrono"] }
 # Signed API session tokens issued after a verified Google OAuth identity.