diff --git a/Cargo.lock b/Cargo.lock
index 774575f..925fd67 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1405,6 +1405,18 @@ dependencies = [
  "version_check",
 ]
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "normalize-line-endings"
 version = "0.3.0"
@@ -2934,14 +2946,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "9e2fc56a6707efb066c40aead2409ebb1224e6dde24a074e9fbc78ced500507b"
 dependencies = [
  "crc32fast",
  "flate2",
  "indexmap",
  "memchr",
+ "nix",
  "typed-path",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index 7758e21..8da3156 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,7 +36,7 @@ quick-xml = { version = "0.42", features = ["escape-html"] }
 # pulling every codec (bzip2/zstd/lzma/aes-crypto chains incl. zstd-sys's C
 # build) and zip's optional `time`. The zlib-rs backend keeps flate2 pure-Rust
 # (no C toolchain) and matches the backend the old default features already used.
-zip = { version = "8.6", default-features = false, features = ["deflate-flate2-zlib-rs"] }
+zip = { version = "9.0", default-features = false, features = ["deflate-flate2-zlib-rs"] }
 # Held below 0.40 deliberately: 0.40 pulls a libsqlite3-sys that uses the
 # `cfg_select!` macro, which does not exist in our MSRV (see docs/msrv-audit.md
 # for why the floor is 1.88 and what it buys). Raising past 0.39 means raising