diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 7b2a2cdb..c6edf3a9 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -1126,7 +1126,7 @@ dependencies = [
  "num-rational",
  "num-traits",
  "once_cell",
- "p256 0.14.0",
+ "p256",
  "rand 0.10.2",
  "rand_chacha 0.10.0",
  "rand_core 0.10.1",
@@ -3328,7 +3328,7 @@ dependencies = [
  "k256",
  "mkit-core",
  "mkit-rpc",
- "p256 0.13.2",
+ "p256",
  "rand_core 0.10.1",
  "serde",
  "serde_json",
@@ -3350,7 +3350,7 @@ dependencies = [
  "k256",
  "mkit-cli",
  "mkit-core",
- "p256 0.13.2",
+ "p256",
  "serde",
  "serde_json",
  "sha1",
@@ -3392,7 +3392,7 @@ dependencies = [
  "mkit-transport-s3",
  "mkit-transport-ssh",
  "mockito",
- "p256 0.13.2",
+ "p256",
  "predicates",
  "proptest",
  "rand_core 0.10.1",
@@ -3481,7 +3481,7 @@ dependencies = [
  "mkit-attest",
  "mkit-core",
  "openpgp-card",
- "p256 0.13.2",
+ "p256",
  "regex",
  "security-framework",
  "sha2 0.10.9",
@@ -3968,18 +3968,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "p256"
-version = "0.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
-dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
- "primeorder 0.13.6",
- "sha2 0.10.9",
-]
-
 [[package]]
 name = "p256"
 version = "0.14.0"
@@ -3989,7 +3977,7 @@ dependencies = [
  "ecdsa 0.17.0",
  "elliptic-curve 0.14.1",
  "primefield",
- "primeorder 0.14.0",
+ "primeorder",
  "sha2 0.11.0",
 ]
 
@@ -4003,7 +3991,7 @@ dependencies = [
  "elliptic-curve 0.14.1",
  "fiat-crypto 0.3.0",
  "primefield",
- "primeorder 0.14.0",
+ "primeorder",
  "sha2 0.11.0",
 ]
 
@@ -4341,15 +4329,6 @@ dependencies = [
  "zeroize",
 ]
 
-[[package]]
-name = "primeorder"
-version = "0.13.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
-dependencies = [
- "elliptic-curve 0.13.8",
-]
-
 [[package]]
 name = "primeorder"
 version = "0.14.0"
@@ -6772,7 +6751,7 @@ dependencies = [
  "elliptic-curve 0.14.1",
  "log",
  "nom 8.0.0",
- "p256 0.14.0",
+ "p256",
  "p384",
  "pbkdf2",
  "pcsc",
diff --git a/rust/benches/Cargo.toml b/rust/benches/Cargo.toml
index d5995285..ddf13abc 100644
--- a/rust/benches/Cargo.toml
+++ b/rust/benches/Cargo.toml
@@ -131,6 +131,6 @@ sha2 = "0.10"
 blake2 = "0.10"
 ed25519-dalek = { version = "2", default-features = false, features = ["std"] }
 k256 = { version = "0.13", default-features = false, features = ["ecdsa", "std"] }
-p256 = { version = "0.13", default-features = false, features = ["ecdsa", "std"] }
+p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std"] }
 tempfile = "3"
 git2 = "0.21"
diff --git a/rust/crates/mkit-attest/Cargo.toml b/rust/crates/mkit-attest/Cargo.toml
index d2b6dd5d..3fa833b4 100644
--- a/rust/crates/mkit-attest/Cargo.toml
+++ b/rust/crates/mkit-attest/Cargo.toml
@@ -87,7 +87,7 @@ k256 = { version = "0.13", optional = true, default-features = false, features =
 # P-256 / secp256r1 / prime256v1 (COSE -7) — WebAuthn, Apple Secure
 # Enclave, Android Keystore, iOS CryptoKit, browser WebCrypto. Gated
 # behind `algo-p256`. Same `0.13` RustCrypto major as k256.
-p256 = { version = "0.13", optional = true, default-features = false, features = ["ecdsa", "std", "pkcs8"] }
+p256 = { version = "0.14", optional = true, default-features = false, features = ["ecdsa", "std", "pkcs8"] }
 # Unconditional (not feature-gated): ES256K/ES256 sign SHA256(pae) when
 # those signer features are on, and every in-toto Statement subject
 # emits a sha256 digest alongside blake3 (SPEC-ATTESTATIONS §4.2) so
diff --git a/rust/crates/mkit-cli/Cargo.toml b/rust/crates/mkit-cli/Cargo.toml
index 21c9f997..63d4b003 100644
--- a/rust/crates/mkit-cli/Cargo.toml
+++ b/rust/crates/mkit-cli/Cargo.toml
@@ -208,7 +208,7 @@ mockito = "1"
 # imports these directly — signing goes through the mkit-attest signers.
 ed25519-dalek = { version = "2", default-features = false, features = ["std"] }
 k256 = { version = "0.13", default-features = false, features = ["ecdsa", "std", "pkcs8"] }
-p256 = { version = "0.13", default-features = false, features = ["ecdsa", "std", "pkcs8"] }
+p256 = { version = "0.14", default-features = false, features = ["ecdsa", "std", "pkcs8"] }
 # Snapshot testing for CLI golden-output fixtures. See issue #164.
 # `filters` feature enables regex-based redaction so version-string
 # bumps don't churn snapshots.
diff --git a/rust/crates/mkit-keystore/Cargo.toml b/rust/crates/mkit-keystore/Cargo.toml
index 61098ee0..9ee2326c 100644
--- a/rust/crates/mkit-keystore/Cargo.toml
+++ b/rust/crates/mkit-keystore/Cargo.toml
@@ -49,7 +49,7 @@ getrandom = "0.4.2"
 keyring-core = { version = "1.0.0", optional = true }
 k256 = { version = "0.13.4", default-features = false, features = ["ecdsa", "std"] }
 openpgp-card = { version = "0.6.1", optional = true }
-p256 = { version = "0.13.2", default-features = false, features = ["ecdsa", "std"] }
+p256 = { version = "0.14.0", default-features = false, features = ["ecdsa", "std"] }
 sha2 = { version = "0.10.9", default-features = false }
 zeroize = "1.8.2"
 yubikey = { version = "0.9.0-pre.0", optional = true }