diff --git a/Cargo.lock b/Cargo.lock
index 419f1ec..e630f76 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1072,7 +1072,7 @@ dependencies = [
  "hmac",
  "jsonwebtoken",
  "oauth2",
- "reqwest",
+ "reqwest 0.13.4",
  "serde",
  "serde_json",
  "sha2",
@@ -1102,7 +1102,7 @@ dependencies = [
  "getrandom 0.2.17",
  "http",
  "rand",
- "reqwest",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "serde_path_to_error",
@@ -1350,6 +1350,37 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "reqwest"
+version = "0.13.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
+dependencies = [
+ "base64",
+ "bytes",
+ "futures-core",
+ "http",
+ "http-body",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "percent-encoding",
+ "pin-project-lite",
+ "serde",
+ "serde_json",
+ "sync_wrapper",
+ "tokio",
+ "tower",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "rfc6979"
 version = "0.4.0"
diff --git a/crates/oauth-as-conformance/Cargo.toml b/crates/oauth-as-conformance/Cargo.toml
index fc7a680..6f4a2c3 100644
--- a/crates/oauth-as-conformance/Cargo.toml
+++ b/crates/oauth-as-conformance/Cargo.toml
@@ -37,5 +37,5 @@ url = "2"
 # silent upgrade can never loosen what it accepts. 5.0.0 is the latest 5.x line release
 # verified against crates.io on 2026-08-07 (MIT OR Apache-2.0).
 oauth2 = { version = "=5.0.0", default-features = false, features = ["reqwest"] }
-reqwest = { version = "0.12", default-features = false, features = ["json"] }
+reqwest = { version = "0.13", default-features = false, features = ["json"] }
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "time"] }