diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..de088db
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "cargo"
+    directory: "/rust"
+    schedule:
+      interval: "weekly"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9f59d34..28372c1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,6 +16,9 @@ on:
       - 'rust/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -38,7 +41,7 @@ jobs:
             abi: x86
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -52,7 +55,7 @@ jobs:
         with:
           targets: ${{ matrix.target }}
 
-      - uses: actions/cache@v4
+      - uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -109,7 +112,7 @@ jobs:
         env:
           TARGET: ${{ matrix.target }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: bin-${{ matrix.abi }}-${{ matrix.profile }}
           path: rust/target/${{ matrix.target }}/${{ matrix.profile }}/ta-enhanced
@@ -119,12 +122,12 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
       - name: Download build artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v8
         with:
           path: artifacts
 
@@ -214,13 +217,13 @@ jobs:
           mv release/*-debug.zip release/dbg/ 2>/dev/null || true
           mv release/*.zip release/rel/ 2>/dev/null || true
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ta-enhanced-release-zip
           path: release/rel/*.zip
           retention-days: 30
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@v7
         with:
           name: ta-enhanced-debug-zip
           path: release/dbg/*.zip
@@ -233,7 +236,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Read version
         id: ver
@@ -241,12 +244,12 @@ jobs:
           ver=$(grep '^version=' module.prop | cut -d= -f2)
           echo "version=${ver}" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ta-enhanced-release-zip
           path: zips/release
 
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@v8
         with:
           name: ta-enhanced-debug-zip
           path: zips/debug
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index f8b7ade..e867e2a 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -130,12 +130,27 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
+[[package]]
+name = "base64"
+version = "0.23.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac07cdecf99051d9a5238b80f35af32cdeba5b336e55d957b318b50137e18da5"
+
 [[package]]
 name = "base64ct"
 version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bit-vec"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b71798fca2c1fe1086445a7258a4bc81e6e49dcd24c8d0dd9a1e57395b603f51"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "bitflags"
 version = "2.11.0"
@@ -647,9 +662,9 @@ dependencies = [
 
 [[package]]
 name = "nix"
-version = "0.29.0"
+version = "0.31.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71e2746dc3a24dd78b3cfcb7be93368c6de9963d30f43a6a73998a9cf4b17b46"
+checksum = "225e7cfe711e0ba79a68baeddb2982723e4235247aefce1482f2f16c27865b66"
 dependencies = [
  "bitflags",
  "cfg-if",
@@ -785,11 +800,11 @@ dependencies = [
 
 [[package]]
 name = "pem"
-version = "3.0.6"
+version = "4.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be"
+checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
 dependencies = [
- "base64",
+ "base64 0.23.1",
  "serde_core",
 ]
 
@@ -898,9 +913,9 @@ dependencies = [
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "e058c7de0b26af77780c769414d6257830bb240f3c38477dbc2c16e5f54d6d4c"
 dependencies = [
  "libc",
  "rand_chacha",
@@ -928,13 +943,15 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.12.1"
+version = "0.14.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48406db8ac1f3cbc7dcdb56ec355343817958a356ff430259bb07baf7607e1e1"
+checksum = "8774e05a7d0de114588e6a28fe7e71694b82614ed569d86d8b389dfbc98b8ad8"
 dependencies = [
  "pem",
  "ring",
+ "rustls-pki-types",
  "time",
+ "x509-parser",
  "yasna",
 ]
 
@@ -1034,9 +1051,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.9"
+version = "0.103.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7df23109aa6c1567d1c575b9952556388da57401e4ace1d15f79eedad0d8f53"
+checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
 dependencies = [
  "ring",
  "rustls-pki-types",
@@ -1089,9 +1106,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
@@ -1218,7 +1235,7 @@ name = "ta-enhanced"
 version = "5.53.1"
 dependencies = [
  "anyhow",
- "base64",
+ "base64 0.23.1",
  "clap",
  "libc",
  "nix",
@@ -1435,7 +1452,7 @@ version = "2.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "02d1a66277ed75f640d608235660df48c8e3c19f3b4edb6a263315626cc3c01d"
 dependencies = [
- "base64",
+ "base64 0.22.1",
  "flate2",
  "log",
  "once_cell",
@@ -1620,6 +1637,7 @@ dependencies = [
  "lazy_static",
  "nom",
  "oid-registry",
+ "ring",
  "rusticata-macros",
  "thiserror",
  "time",
@@ -1627,10 +1645,11 @@ dependencies = [
 
 [[package]]
 name = "yasna"
-version = "0.5.2"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e17bb3549cc1321ae1296b9cdc2698e2b6cb1992adfa19a8c72e5b7a738f44cd"
+checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
 dependencies = [
+ "bit-vec",
  "time",
 ]
 
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 126ade6..4559bbe 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2021"
 [dependencies]
 clap = { version = "= 4.5.57", features = ["derive"] }
 serde = { version = "= 1.0.228", features = ["derive"] }
-serde_json = "= 1.0.149"
+serde_json = "= 1.0.151"
 toml = "= 0.8.23"
 tracing = { version = "= 0.1.44", features = ["log"] }
 tracing-subscriber = { version = "= 0.3.22", features = ["env-filter"] }
@@ -14,11 +14,11 @@ anyhow = "= 1.0.101"
 libc = "= 0.2.180"
 ureq = { version = "= 2.12.1", features = ["tls"] }
 quick-xml = { version = "= 0.37.2", features = ["serialize"] }
-base64 = "= 0.22.1"
-nix = { version = "= 0.29.0", features = ["signal", "process"] }
+base64 = "= 0.23.1"
+nix = { version = "= 0.31.1", features = ["signal", "process"] }
 ring = "0.17"
 x509-parser = "= 0.18.1"
-rcgen = { version = "0.12", default-features = false, features = ["pem", "ring"] }
+rcgen = { version = "0.14", default-features = false, features = ["pem", "ring"] }
 rsa = { version = "0.9", default-features = false, features = ["std", "pem"] }
 p256 = { version = "= 0.13.2", default-features = false, features = ["std", "pem", "pkcs8", "ecdsa"] }
 p384 = { version = "= 0.13.1", default-features = false, features = ["std", "pem", "pkcs8", "ecdsa"] }
diff --git a/rust/src/keybox/generate.rs b/rust/src/keybox/generate.rs
index 47c750a..87492b4 100644
--- a/rust/src/keybox/generate.rs
+++ b/rust/src/keybox/generate.rs
@@ -1,5 +1,5 @@
 use anyhow::{Context, Result};
-use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256};
+use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256};
 use rsa::RsaPrivateKey;
 use rsa::pkcs8::EncodePrivateKey;
 
@@ -33,15 +33,16 @@ pub fn generate_and_install() -> Result<()> {
 
 fn generate() -> Result<String> {
     let mut params = CertificateParams::default();
-    params.alg = &PKCS_ECDSA_P256_SHA256;
     params.distinguished_name = DistinguishedName::new();
     params.distinguished_name.push(DnType::CommonName, "Android Keybox");
 
-    let cert = Certificate::from_params(params)
+    let ec_key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256)
+        .context("EC key generation failed")?;
+    let cert = params
+        .self_signed(&ec_key)
         .context("EC cert generation failed")?;
-    let ec_pem = cert.serialize_private_key_pem();
-    let cert_pem = cert.serialize_pem()
-        .context("cert serialization failed")?;
+    let ec_pem = ec_key.serialize_pem();
+    let cert_pem = cert.pem();
 
     let mut rng = rand::rngs::OsRng;
     let rsa_key = RsaPrivateKey::new(&mut rng, 2048)
diff --git a/rust/src/keybox/validate.rs b/rust/src/keybox/validate.rs
index f5950fa..bee3444 100644
--- a/rust/src/keybox/validate.rs
+++ b/rust/src/keybox/validate.rs
@@ -767,18 +767,18 @@ mod tests {
 
     #[test]
     fn ecdsa_p256_self_signed_link_verifies() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.distinguished_name = DistinguishedName::new();
         params
             .distinguished_name
             .push(DnType::CommonName, "test-leaf");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
 
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
         verify_link(&parsed, &parsed).expect("self-signed P-256 link verifies");
     }
 
@@ -811,18 +811,18 @@ mod tests {
 
     #[test]
     fn lookup_revocation_finds_serial() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256, SerialNumber};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256, SerialNumber};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.serial_number = Some(SerialNumber::from(0xdead_beefu64));
         params.distinguished_name = DistinguishedName::new();
         params
             .distinguished_name
             .push(DnType::CommonName, "rev-test");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
 
         let mut entries = serde_json::Map::new();
         entries.insert(
@@ -839,16 +839,16 @@ mod tests {
 
     #[test]
     fn lookup_revocation_returns_none_when_clean() {
-        use rcgen::{Certificate, CertificateParams, DistinguishedName, DnType, PKCS_ECDSA_P256_SHA256, SerialNumber};
+        use rcgen::{CertificateParams, DistinguishedName, DnType, KeyPair, PKCS_ECDSA_P256_SHA256, SerialNumber};
 
         let mut params = CertificateParams::default();
-        params.alg = &PKCS_ECDSA_P256_SHA256;
         params.serial_number = Some(SerialNumber::from(0x1234u64));
         params.distinguished_name = DistinguishedName::new();
         params.distinguished_name.push(DnType::CommonName, "clean");
-        let cert = Certificate::from_params(params).expect("rcgen build");
-        let der = cert.serialize_der().expect("rcgen serialize");
-        let (_, parsed) = X509Certificate::from_der(&der).expect("x509 parse");
+        let key = KeyPair::generate_for(&PKCS_ECDSA_P256_SHA256).expect("rcgen key");
+        let cert = params.self_signed(&key).expect("rcgen build");
+        let der = cert.der();
+        let (_, parsed) = X509Certificate::from_der(der.as_ref()).expect("x509 parse");
 
         let mut entries = serde_json::Map::new();
         entries.insert(
diff --git a/rust/src/platform/signal.rs b/rust/src/platform/signal.rs
index 151e5a2..82952f9 100644
--- a/rust/src/platform/signal.rs
+++ b/rust/src/platform/signal.rs
@@ -5,7 +5,7 @@ pub static SHUTDOWN: AtomicBool = AtomicBool::new(false);
 pub fn register_shutdown_handler() {
     unsafe {
         let mut sa: libc::sigaction = std::mem::zeroed();
-        sa.sa_sigaction = shutdown_handler as usize;
+        sa.sa_sigaction = shutdown_handler as *const () as usize;
         sa.sa_flags = libc::SA_RESTART;
         libc::sigaction(libc::SIGTERM, &sa, std::ptr::null_mut());
         libc::sigaction(libc::SIGINT, &sa, std::ptr::null_mut());