diff --git a/CHANGELOG.md b/CHANGELOG.md
index b2100c4..4a223f6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -416,6 +416,14 @@ agent/PR/role/size/invariant audit trail.
 
 ### Changed
 
+- **Rust security and maintenance dependencies (PR #96).** Updated `serde_json`,
+  `jsonwebtoken`, `tree-sitter`, `serde`, `tokio`, `tokio-stream`, `syn`,
+  `quote`, and `proc-macro2` to their current releases. The `jsonwebtoken` 11
+  migration retains the explicit AWS-LC backend and PEM support, while the
+  `syn` 3 migration remains confined to the non-nano tool-macro crate. Full
+  feature builds, GitHub App signing tests, proc-macro tests, dependency audit,
+  and the nano isolation/size gates remain green.
+
 - **GitHub Actions checkout maintenance (PR #95).** Updated every CI and release
   workflow use of `actions/checkout` from immutable SHA-pinned v7.0.0 to v7.0.1.
   The patch release fixes unsafe-PR-check handling, branch whitespace parsing,
@@ -459,6 +467,7 @@ agent/PR/role/size/invariant audit trail.
 
 | Date | Phase/Task | Change | PR / Branch | Agent / Role | Nano Δ | Invariants |
 | --- | --- | --- | --- | --- | --- | --- |
+| 2026-07-29 | dependency-maintenance | Update nine Rust security/maintenance dependencies, including `jsonwebtoken` 11 and `syn` 3, while retaining AWS-LC and non-nano feature isolation | `#96` / `dependabot/cargo/rust-security-and-maintenance-f84a6d97b2` | Codex (Supervisor/Reviewer) | 0 kB (444.6 KiB measured; non-nano deps) | Verifies 1-3, 13, 19, 20; signing, macro, audit, full-feature, and nano gates required |
 | 2026-07-29 | dependency-maintenance | Pin all CI/release checkout steps to `actions/checkout` v7.0.1 and retain immutable-SHA supply-chain policy | `#95` / `dependabot/github_actions/actions/checkout-7.0.1` | Codex (Supervisor/Reviewer) | 0 kB (workflow only) | Verifies 13, 19, 20; full verifier and nano-size gate required |
 | 2026-07-15 | dependency-maintenance | Repair grouped security/maintenance updates: migrate all `ureq` 3 live adapters plus vault crypto/RNG APIs; preserve bounded bodies, secret confinement, authenticated vault format, and feature isolation | `#93` / `dependabot/cargo/rust-security-and-maintenance-d4da4f9c56` | Codex (Supervisor/Implementer) | 0 kB (444.6 KiB measured; non-nano deps) | Verifies 1-3, 11, 13, 19, 20; no secret exposure, full verifier required |
 | 2026-07-12 | end-to-end-hardening | Sandbox/capability/budget seals; non-cloneable verifier evidence; durable event-log + receipt join; real confined verified-patch-to-draft-PR path; unique daemon task ids; AWS-LC JWT migration; supply-chain policy | `codex/end-to-end-hardening` | Codex (Supervisor/Implementer) | +16.5 KiB local macOS nano (444.6 KiB total, 55.6%) | Enforces 1-3, 6-14, 18-20; completion now requires persisted joined evidence |
diff --git a/Cargo.lock b/Cargo.lock
index 2abba36..8f4330e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -548,7 +548,7 @@ dependencies = [
  "crustcore-types",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
  "trybuild",
 ]
 
@@ -891,9 +891,9 @@ dependencies = [
 
 [[package]]
 name = "jsonwebtoken"
-version = "10.4.0"
+version = "11.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eba32bfb4ffdeaca3e34431072faf01745c9b26d25504aa7a6cf5684334fc4fc"
+checksum = "881733cbc631fc9e472e24447ce32a64bedf2da498d6d8570b08edc87de71f65"
 dependencies = [
  "aws-lc-rs",
  "base64",
@@ -1055,18 +1055,18 @@ checksum = "439ee305def115ba05938db6eb1644ff94165c5ab5e9420d1c1bcedbba909391"
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.106"
+version = "1.0.107"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
 dependencies = [
  "unicode-ident",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.46"
+version = "1.0.47"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
 dependencies = [
  "proc-macro2",
 ]
@@ -1206,9 +1206,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -1216,29 +1216,29 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 3.0.3",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.150"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "indexmap",
  "itoa",
@@ -1360,9 +1360,20 @@ checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
 [[package]]
 name = "syn"
-version = "2.0.118"
+version = "2.0.119"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1407,7 +1418,7 @@ checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -1442,9 +1453,9 @@ dependencies = [
 
 [[package]]
 name = "tokio"
-version = "1.52.3"
+version = "1.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fc7f01b389ac15039e4dc9531aa973a135d7a4135281b12d7c1bc79fd57fffe"
+checksum = "202caea871b69668250d242070849eb495be178ed697a3e98aebce5bc81a0bed"
 dependencies = [
  "bytes",
  "libc",
@@ -1463,14 +1474,14 @@ checksum = "385a6cb71ab9ab790c5fe8d67f1645e6c450a7ce006a33de03daa956cf70a496"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
 name = "tokio-stream"
-version = "0.1.18"
+version = "0.1.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+checksum = "a3d06f0b082ba57c26b79407372e57cf2a1e28124f78e9479fe80322cf53420b"
 dependencies = [
  "futures-core",
  "pin-project-lite",
@@ -1545,9 +1556,9 @@ checksum = "8df9b6e13f2d32c91b9bd719c00d1958837bc7dec474d94952798cc8e69eeec3"
 
 [[package]]
 name = "tree-sitter"
-version = "0.26.10"
+version = "0.26.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c343ed63e3f5c64d1acdecb5d2c13d4e169cb5fde0052106ebaa6c6f27f9e55"
+checksum = "af1c71c1c4cc0920b20d6b0f6572e7682cd07a6a2faec71067a31fa394c586df"
 dependencies = [
  "cc",
  "regex",
@@ -1695,7 +1706,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
  "wasm-bindgen-shared",
 ]
 
@@ -1844,7 +1855,7 @@ checksum = "3c50655cbb0fe3fc43170059e702f1ce5e19b84cec58dc87b037a09935c2f328"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn",
+ "syn 2.0.119",
 ]
 
 [[package]]
diff --git a/crates/crustcore-net/Cargo.toml b/crates/crustcore-net/Cargo.toml
index b347ff2..619f192 100644
--- a/crates/crustcore-net/Cargo.toml
+++ b/crates/crustcore-net/Cargo.toml
@@ -34,7 +34,7 @@ ureq = { version = "3", optional = true }
 # helper + nano, which never links this crate at all) pulls none of them.
 # `jsonwebtoken` is pinned to its AWS-LC backend: constant-time, audited crypto
 # without the RustCrypto `rsa` crate's unpatched Marvin timing advisory.
-jsonwebtoken = { version = "10.4", default-features = false, features = ["aws_lc_rs", "use_pem"], optional = true }
+jsonwebtoken = { version = "11.0", default-features = false, features = ["aws_lc_rs", "use_pem"], optional = true }
 
 [features]
 # Enables the real network transport (`UreqClient`) + the `live_engine` builder, and
diff --git a/crates/crustcore-tool-macro/Cargo.toml b/crates/crustcore-tool-macro/Cargo.toml
index 1dc816e..3040805 100644
--- a/crates/crustcore-tool-macro/Cargo.toml
+++ b/crates/crustcore-tool-macro/Cargo.toml
@@ -20,7 +20,7 @@ description = "The #[crust_tool] proc-macro: derives schema + bounded I/O + reda
 proc-macro = true
 
 [dependencies]
-syn = { version = "2", features = ["full"] }
+syn = { version = "3", features = ["full"] }
 quote = "1"
 proc-macro2 = "1"
 # Off-by-default UI-test harness for the compile-fail cases. Declared as a normal