diff --git a/Cargo.lock b/Cargo.lock
index 7e92c575..855ba406 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2174,9 +2174,9 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "10.4.0"
+version = "11.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
+checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1"
 dependencies = [
  "aws-lc-rs",
  "base64 0.22.1",
diff --git a/builtins/plugins/identity-jwt/Cargo.toml b/builtins/plugins/identity-jwt/Cargo.toml
index 02ca260a..58f245b5 100644
--- a/builtins/plugins/identity-jwt/Cargo.toml
+++ b/builtins/plugins/identity-jwt/Cargo.toml
@@ -42,7 +42,7 @@ cpex-core = { workspace = true }
 # timing sidechannel) with no fixed release — which then propagates the
 # advisory to every downstream consumer of this plugin. aws-lc-rs keeps
 # `rsa` out of the runtime tree at the cost of a C/cmake build step.
-jsonwebtoken = { version = "10", features = ["aws_lc_rs"] }
+jsonwebtoken = { version = "11", features = ["aws_lc_rs"] }
 
 # `base64` for the peek-at-iss helper (split + URL_SAFE_NO_PAD decode
 # of the middle JWT segment). Pinned to 0.22 to match what