diff --git a/Cargo.lock b/Cargo.lock
index 7620e67..bd2976c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4875,9 +4875,9 @@ dependencies = [
 
 [[package]]
 name = "spin"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+checksum = "023a211cb3138dbc438680b32560ad89f699977624c9f8dbb95a47d5b4c07dd3"
 
 [[package]]
 name = "spki"
@@ -5977,11 +5977,11 @@ dependencies = [
 
 [[package]]
 name = "ulid"
-version = "1.2.1"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+checksum = "39493d572b98fe1d142e132e7a726c50c68121bce84429216a5ec20e1ad7fec5"
 dependencies = [
- "rand 0.9.4",
+ "rand 0.10.2",
  "web-time",
 ]
 
diff --git a/crates/vegify-core/Cargo.toml b/crates/vegify-core/Cargo.toml
index f9096b3..9f237dd 100644
--- a/crates/vegify-core/Cargo.toml
+++ b/crates/vegify-core/Cargo.toml
@@ -13,7 +13,7 @@ serde = { version = "1.0", features = ["derive"] }
 # Pinned to match the desktop's ttipc/specta so the `Type` impls are the SAME trait the
 # `#[procedures]` macro consumes (a version skew would make them distinct traits and fail to compile).
 specta = { version = "=2.0.0-rc.25", features = ["derive"] }
-ulid = "1"
+ulid = "2"
 
 [lints]
 workspace = true
diff --git a/crates/vegify-core/src/lib.rs b/crates/vegify-core/src/lib.rs
index 55e7db8..f9e3689 100644
--- a/crates/vegify-core/src/lib.rs
+++ b/crates/vegify-core/src/lib.rs
@@ -22,7 +22,7 @@ use ulid::Ulid;
 /// A fresh client-side ULID (text id). Minted on insert when no id is supplied; a supplied id is
 /// honored, so offline creates and sync re-applies stay authoritative.
 pub fn new_id() -> String {
-    Ulid::new().to_string()
+    Ulid::gen().to_string()
 }
 
 /// The crate error. `Db` = a SQLite/data failure (incl. the owner-guard messages); `Auth` is