diff --git a/Cargo.lock b/Cargo.lock
index a7c7324..3bacb1c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1499,7 +1499,7 @@ dependencies = [
 name = "tinydocs-module"
 version = "0.1.14"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "getrandom 0.3.4",
  "serde",
  "serde_json",
diff --git a/crates/tinydocs-module/Cargo.toml b/crates/tinydocs-module/Cargo.toml
index 5b2879d..82455bf 100644
--- a/crates/tinydocs-module/Cargo.toml
+++ b/crates/tinydocs-module/Cargo.toml
@@ -24,7 +24,7 @@ tinybus-module = { version = "0.1.0", path = "../../vendor/tinybus/crates/tinybu
 tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
 # Bus frames are JSON, where a byte array costs ~3.5 bytes per byte. Chunks are
 # base64 (1.34x) so a 4 MiB chunk fits a frame with room to spare.
-base64 = "0.22"
+base64 = "0.23"
 # Chunked transfer verifies each assembled blob against a caller-declared digest
 # before it becomes readable, so a truncated upload cannot be consumed as whole.
 sha2 = "0.10"
@@ -43,7 +43,7 @@ workspace = true
 
 [dev-dependencies]
 # The loader E2E test speaks the base64 transfer surface the same way a host does.
-base64 = "0.22"
+base64 = "0.23"
 # `GeneratePptx` takes a deck whose images name staged blobs; the test builds that
 # document directly rather than depending on the module's own wire types, so a
 # rename here would be caught as a contract change.