diff --git a/Cargo.lock b/Cargo.lock
index a247391..86775f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1929,9 +1929,9 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "10.3.0"
+version = "10.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0529410abe238729a60b108898784df8984c87f6054c9c4fcacc47e4803c1ce1"
+checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
 dependencies = [
  "aws-lc-rs",
  "base64",
@@ -1940,6 +1940,7 @@ dependencies = [
  "serde",
  "serde_json",
  "signature",
+ "zeroize",
 ]
 
 [[package]]
@@ -5728,6 +5729,20 @@ name = "zeroize"
 version = "1.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b97154e67e32c85465826e8bcc1c59429aaaf107c1e4a9e53c8d8ccd5eff88d0"
+dependencies = [
+ "zeroize_derive",
+]
+
+[[package]]
+name = "zeroize_derive"
+version = "1.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85a5b4158499876c763cb03bc4e49185d3cccbabb15b33c627f7884f43db852e"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
 
 [[package]]
 name = "zerotrie"
diff --git a/crates/rustapi-extras/Cargo.toml b/crates/rustapi-extras/Cargo.toml
index 2c0f27e..b598ae5 100644
--- a/crates/rustapi-extras/Cargo.toml
+++ b/crates/rustapi-extras/Cargo.toml
@@ -33,7 +33,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 
 # JWT (feature-gated)
-jsonwebtoken = { version = "=10.3.0", optional = true, default-features = false, features = ["aws_lc_rs"] }
+jsonwebtoken = { version = "=10.4.0", optional = true, default-features = false, features = ["aws_lc_rs"] }
 aws-lc-rs = { version = "1.17", optional = true, features = ["prebuilt-nasm"] }
 
 # Rate limiting (feature-gated)