Merge branch 'upgrade-rand'

30 files changed, 67 insertions, 67 deletions

diff --git a/Cargo.lock b/Cargo.lock
index 55b56b6873..62ac26d187 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2416,7 +2416,7 @@ dependencies = [
  "mullvad-version",
  "native-windows-gui",
  "objc_id",
- "rand 0.8.5",
+ "rand 0.9.2",
  "reqwest",
  "serde",
  "talpid-platform-metadata",
@@ -3111,7 +3111,7 @@ dependencies = [
  "notify 8.0.0",
  "objc2-foundation 0.3.1",
  "objc2-service-management",
- "rand 0.8.5",
+ "rand 0.9.2",
  "regex",
  "serde",
  "serde_json",
@@ -3198,8 +3198,6 @@ dependencies = [
 name = "mullvad-jni"
 version = "0.0.0"
 dependencies = [
- "futures",
- "ipnetwork",
  "jnix",
  "log",
  "log-panics",
@@ -3207,7 +3205,6 @@ dependencies = [
  "mullvad-daemon",
  "mullvad-problem-report",
  "mullvad-types",
- "rand 0.8.5",
  "talpid-platform-metadata",
  "talpid-tunnel",
  "talpid-types",
@@ -3273,7 +3270,7 @@ dependencies = [
  "libc",
  "log",
  "quinn",
- "rand 0.8.5",
+ "rand 0.9.2",
  "rustls 0.23.18",
  "rustls-pemfile 2.1.3",
  "socket2 0.5.8",
@@ -3337,7 +3334,7 @@ dependencies = [
  "log",
  "mullvad-types",
  "proptest",
- "rand 0.8.5",
+ "rand 0.9.2",
  "serde_json",
  "talpid-types",
  "thiserror 2.0.9",
@@ -3354,7 +3351,6 @@ dependencies = [
  "hex",
  "mullvad-update",
  "mullvad-version",
- "rand 0.8.5",
  "reqwest",
  "serde",
  "serde_json",
@@ -3422,6 +3418,7 @@ dependencies = [
  "mullvad-api-constants",
  "mullvad-version",
  "rand 0.8.5",
+ "rand 0.9.2",
  "reqwest",
  "serde",
  "serde_json",
@@ -5645,7 +5642,7 @@ name = "talpid-future"
 version = "0.0.0"
 dependencies = [
  "proptest",
- "rand 0.8.5",
+ "rand 0.9.2",
  "talpid-time",
  "tokio",
 ]
@@ -5858,6 +5855,7 @@ dependencies = [
  "parking_lot",
  "proptest",
  "rand 0.8.5",
+ "rand 0.9.2",
  "rand_chacha 0.3.1",
  "rtnetlink",
  "socket2 0.5.8",
diff --git a/Cargo.toml b/Cargo.toml
index 4a787953bd..fe2f6b61c3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -97,6 +97,7 @@ serde_json = "1.0.122"
 windows-sys = "0.52.0"
 nix = "0.30.1"
 strum = { version = "0.27" }
+rand = "0.9"
 
 # Networking
 pnet_packet = "0.35.0"
diff --git a/installer-downloader/Cargo.toml b/installer-downloader/Cargo.toml
index 0a5f306a3d..bdfc0a46f1 100644
--- a/installer-downloader/Cargo.toml
+++ b/installer-downloader/Cargo.toml
@@ -24,7 +24,7 @@ chrono = { workspace = true, features = ["clock"] }
 fern = { workspace = true }
 hex = "0.4"
 log = { workspace = true }
-rand = { version = "0.8.5" }
+rand = { workspace = true }
 reqwest = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = ["rt-multi-thread", "fs"] }
diff --git a/installer-downloader/src/controller.rs b/installer-downloader/src/controller.rs
index c96c20006f..9967c232c9 100644
--- a/installer-downloader/src/controller.rs
+++ b/installer-downloader/src/controller.rs
@@ -15,7 +15,7 @@ use mullvad_update::{
     version::{Version, VersionInfo, VersionParameters},
     version_provider::VersionInfoProvider,
 };
-use rand::seq::SliceRandom;
+use rand::seq::IndexedRandom;
 use std::{cmp::Ordering, path::PathBuf};
 use tokio::{
     sync::{mpsc, oneshot},
@@ -582,7 +582,7 @@ impl<D: AppDelegate + 'static, A: From<UiAppDownloaderParameters<D>> + AppDownlo
 /// Select a mirror to download from
 /// Currently, the selection is random
 fn select_cdn_url(urls: &[String]) -> Option<&str> {
-    urls.choose(&mut rand::thread_rng()).map(String::as_str)
+    urls.choose(&mut rand::rng()).map(String::as_str)
 }
 
 fn format_latest_version(version: &Version) -> String {
diff --git a/installer-downloader/src/temp.rs b/installer-downloader/src/temp.rs
index 42f66418a9..4cb3ea8e0b 100644
--- a/installer-downloader/src/temp.rs
+++ b/installer-downloader/src/temp.rs
@@ -76,13 +76,13 @@ async fn admin_temp_dir() -> anyhow::Result<PathBuf> {
 /// See [module-level](self) docs for more information.
 #[cfg(target_os = "macos")]
 async fn temp_dir() -> anyhow::Result<PathBuf> {
-    use rand::{Rng, distributions::Alphanumeric};
+    use rand::{Rng, distr::Alphanumeric};
     use std::{fs::Permissions, os::unix::fs::PermissionsExt};
     use tokio::fs;
 
     // Randomly generate a directory name
     let dir_name: String = (0..10)
-        .map(|_| rand::thread_rng().sample(Alphanumeric) as char)
+        .map(|_| rand::rng().sample(Alphanumeric) as char)
         .collect();
     let temp_dir = std::env::temp_dir().join(dir_name);
 
diff --git a/mullvad-daemon/Cargo.toml b/mullvad-daemon/Cargo.toml
index b444631bf1..d0999dbee1 100644
--- a/mullvad-daemon/Cargo.toml
+++ b/mullvad-daemon/Cargo.toml
@@ -32,6 +32,7 @@ tokio = { workspace = true, features =  ["fs", "io-util", "rt-multi-thread", "sy
 tokio-stream = { version = "0.1", features = ["sync"]}
 socket2 = { workspace = true }
 ipnetwork = { workspace = true }
+rand = { workspace = true }
 
 mullvad-relay-selector = { path = "../mullvad-relay-selector" }
 mullvad-types = { path = "../mullvad-types" }
@@ -48,7 +49,6 @@ talpid-platform-metadata = { path = "../talpid-platform-metadata" }
 talpid-time = { path = "../talpid-time" }
 talpid-types = { path = "../talpid-types" }
 talpid-routing = { path = "../talpid-routing" }
-rand = "0.8.5"
 
 clap = { workspace = true }
 log-panics = "2.0.0"
diff --git a/mullvad-daemon/src/version/downloader.rs b/mullvad-daemon/src/version/downloader.rs
index f02e171928..56ff3dea76 100644
--- a/mullvad-daemon/src/version/downloader.rs
+++ b/mullvad-daemon/src/version/downloader.rs
@@ -4,7 +4,7 @@ use mullvad_types::version::{AppUpgradeDownloadProgress, AppUpgradeError, AppUpg
 use mullvad_update::app::{
     AppDownloader, AppDownloaderParameters, DownloadError, DownloadedInstaller, bin_path,
 };
-use rand::seq::SliceRandom;
+use rand::seq::IndexedRandom;
 use std::io;
 use std::path::PathBuf;
 use std::time::{Duration, Instant};
@@ -230,7 +230,7 @@ fn estimate_time_left(
 /// Select a mirror to download from
 /// Currently, the selection is random
 fn select_cdn_url(urls: &[String]) -> Option<&str> {
-    urls.choose(&mut rand::thread_rng()).map(String::as_str)
+    urls.choose(&mut rand::rng()).map(String::as_str)
 }
 
 /// Extract domain name from a URL
diff --git a/mullvad-jni/Cargo.toml b/mullvad-jni/Cargo.toml
index 92e55f87e6..e97785d1c2 100644
--- a/mullvad-jni/Cargo.toml
+++ b/mullvad-jni/Cargo.toml
@@ -22,12 +22,9 @@ crate-type = ["cdylib"]
 tokio = { workspace = true, features = ["rt"] }
 
 thiserror = { workspace = true }
-futures = { workspace = true }
-ipnetwork = { workspace = true }
 jnix = { version = "0.5.1", features = ["derive"] }
 log = { workspace = true }
 log-panics = "2"
-rand = "0.8.5"
 
 mullvad-api = { path = "../mullvad-api" }
 mullvad-daemon = { path = "../mullvad-daemon" }
diff --git a/mullvad-masque-proxy/Cargo.toml b/mullvad-masque-proxy/Cargo.toml
index f0120a27f9..ff3c474020 100644
--- a/mullvad-masque-proxy/Cargo.toml
+++ b/mullvad-masque-proxy/Cargo.toml
@@ -35,7 +35,7 @@ features = ["Win32", "Win32_Foundation", "Win32_Networking", "Win32_Networking_W
 env_logger = { workspace = true }
 tokio = { workspace = true, features = ["fs", "macros", "io-util", "rt-multi-thread"] }
 clap = { workspace = true }
-rand = "0.8.5"
+rand = { workspace = true }
 criterion = { version = "0.7.0", features = ["html_reports"] }
 talpid-tunnel = { path = "../talpid-tunnel" }
 
diff --git a/mullvad-masque-proxy/src/fragment.rs b/mullvad-masque-proxy/src/fragment.rs
index d4cfca5496..9fc6474370 100644
--- a/mullvad-masque-proxy/src/fragment.rs
+++ b/mullvad-masque-proxy/src/fragment.rs
@@ -200,7 +200,7 @@ pub fn fragment_packet(
 mod test {
     use std::collections::HashSet;
 
-    use rand::{seq::SliceRandom, thread_rng};
+    use rand::{rng, seq::SliceRandom};
 
     use super::*;
 
@@ -217,7 +217,7 @@ mod test {
                 .unwrap()
                 .collect::<Vec<_>>();
 
-            fragment_buf.shuffle(&mut thread_rng());
+            fragment_buf.shuffle(&mut rng());
 
             for fragment in fragment_buf {
                 if let DefragReceived::Reassembled(reconstructed_packet) =
@@ -250,7 +250,7 @@ mod test {
             fragment_buf
                 .extend(&mut fragment_packet(max_payload_size, &mut payload, packet_id).unwrap());
         }
-        fragment_buf.shuffle(&mut thread_rng());
+        fragment_buf.shuffle(&mut rng());
 
         for fragment in fragment_buf {
             if let DefragReceived::Reassembled(reconstructed_packet) =
@@ -284,7 +284,7 @@ mod test {
                 .unwrap()
                 .collect::<Vec<_>>();
 
-            fragment_buf.shuffle(&mut thread_rng());
+            fragment_buf.shuffle(&mut rng());
 
             // send one fragment
             let packet = fragments
diff --git a/mullvad-masque-proxy/tests/proxy.rs b/mullvad-masque-proxy/tests/proxy.rs
index 4efb1e7fc9..b8681166c1 100644
--- a/mullvad-masque-proxy/tests/proxy.rs
+++ b/mullvad-masque-proxy/tests/proxy.rs
@@ -74,7 +74,7 @@ async fn test_server_and_client_fragmentation() -> anyhow::Result<()> {
         // Proxy client -> destination
         // Send a random packet, large enough to be fragmented
         let mut fragment_me = vec![0u8; send_packet_size];
-        rand::thread_rng().fill_bytes(&mut fragment_me);
+        rand::rng().fill_bytes(&mut fragment_me);
 
         client.send(&fragment_me).await?;
 
@@ -92,7 +92,7 @@ async fn test_server_and_client_fragmentation() -> anyhow::Result<()> {
         // Destination -> proxy client
         // Send a random packet, large enough to be fragmented
         let mut fragment_me = vec![0u8; send_packet_size];
-        rand::thread_rng().fill_bytes(&mut fragment_me);
+        rand::rng().fill_bytes(&mut fragment_me);
 
         server.send_to(&fragment_me, proxy_addr).await?;
 
diff --git a/mullvad-relay-selector/Cargo.toml b/mullvad-relay-selector/Cargo.toml
index 8c5e49971f..5e5a379dc4 100644
--- a/mullvad-relay-selector/Cargo.toml
+++ b/mullvad-relay-selector/Cargo.toml
@@ -20,7 +20,7 @@ thiserror = { workspace = true }
 ipnetwork = { workspace = true }
 itertools = { workspace = true }
 log = { workspace = true }
-rand = "0.8.5"
+rand = { workspace = true }
 serde_json = { workspace = true }
 
 talpid-types = { path = "../talpid-types" }
diff --git a/mullvad-relay-selector/src/relay_selector/detailer.rs b/mullvad-relay-selector/src/relay_selector/detailer.rs
index 0faccdb5c4..1d61e77dff 100644
--- a/mullvad-relay-selector/src/relay_selector/detailer.rs
+++ b/mullvad-relay-selector/src/relay_selector/detailer.rs
@@ -19,6 +19,7 @@ use mullvad_types::{
         WireguardEndpointData,
     },
 };
+use rand::seq::IndexedRandom;
 use talpid_types::net::{
     Endpoint, IpVersion, TransportProtocol,
     proxy::Shadowsocks,
@@ -232,7 +233,7 @@ fn openvpn_singlehop_endpoint(
     data.ports
         .iter()
         .filter(|&endpoint| compatible_openvpn_port_combo(port_constraint, endpoint))
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .map(|endpoint| Endpoint::new(exit.ipv4_addr_in, endpoint.port, endpoint.protocol))
         .ok_or(Error::NoOpenVpnEndpoint)
 }
@@ -252,7 +253,7 @@ fn openvpn_bridge_endpoint(
         .iter()
         .filter(|endpoint| matches!(endpoint.protocol, TransportProtocol::Tcp))
         .filter(|endpoint| compatible_openvpn_port_combo(port_constraint, endpoint))
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .map(|endpoint| Endpoint::new(exit.ipv4_addr_in, endpoint.port, endpoint.protocol))
         .ok_or(Error::NoBridgeEndpoint)
 }
@@ -276,12 +277,11 @@ fn compatible_openvpn_port_combo(
 
 /// Picks a random bridge from a relay.
 pub fn bridge_endpoint(data: &BridgeEndpointData, relay: &Relay) -> Option<Shadowsocks> {
-    use rand::seq::SliceRandom;
     if relay.endpoint_data != RelayEndpointData::Bridge {
         return None;
     }
     data.shadowsocks
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .inspect(|shadowsocks_endpoint| {
             log::info!(
                 "Selected Shadowsocks bridge {} at {}:{}/{}",
diff --git a/mullvad-relay-selector/src/relay_selector/helpers.rs b/mullvad-relay-selector/src/relay_selector/helpers.rs
index f80942d0f5..23a050b6c6 100644
--- a/mullvad-relay-selector/src/relay_selector/helpers.rs
+++ b/mullvad-relay-selector/src/relay_selector/helpers.rs
@@ -13,8 +13,7 @@ use mullvad_types::{
 };
 use rand::{
     Rng,
-    seq::{IteratorRandom, SliceRandom},
-    thread_rng,
+    seq::{IndexedRandom, IteratorRandom},
 };
 use talpid_types::net::{IpVersion, obfuscation::ObfuscatorConfig};
 
@@ -55,7 +54,7 @@ pub fn pick_random_relay_weighted<'a, RelayType>(
     weight: impl Fn(&'a RelayType) -> u64,
 ) -> Option<&'a RelayType> {
     let total_weight: u64 = relays.clone().map(&weight).sum();
-    let mut rng = thread_rng();
+    let mut rng = rand::rng();
     if total_weight == 0 {
         relays.choose(&mut rng)
     } else {
@@ -73,7 +72,7 @@ pub fn pick_random_relay_weighted<'a, RelayType>(
         //  ------------------------------------                          ------------
         //         |                  |                                         |
         //   weight(relay 0)     weight(relay 1)    ..       ..     ..    weight(relay n)
-        let mut i: u64 = rng.gen_range(1..=total_weight);
+        let mut i: u64 = rng.random_range(1..=total_weight);
         Some(
             relays
                 .find(|relay| {
@@ -166,7 +165,7 @@ fn get_udp2tcp_obfuscator_port(
             .copied()
     } else {
         // There are no specific obfuscation settings to take into consideration in this case.
-        udp2tcp_ports.choose(&mut thread_rng()).copied()
+        udp2tcp_ports.choose(&mut rand::rng()).copied()
     };
     port.ok_or(Error::NoMatchingPort)
 }
@@ -254,7 +253,7 @@ fn get_shadowsocks_obfuscator_inner<R: RangeBounds<u16> + Iterator<Item = u16> +
 
     let in_ip = extra_in_addrs
         .iter()
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .copied()
         .unwrap_or(wg_in_addr);
 
@@ -308,7 +307,7 @@ pub fn select_random_port<R: RangeBounds<u16> + Iterator<Item = u16> + Clone>(
         .iter()
         .cloned()
         .flatten()
-        .choose(&mut rand::thread_rng())
+        .choose(&mut rand::rng())
         .ok_or(Error::NoMatchingPort)
 }
 
diff --git a/mullvad-update/Cargo.toml b/mullvad-update/Cargo.toml
index 4a60350d27..85a85d94c5 100644
--- a/mullvad-update/Cargo.toml
+++ b/mullvad-update/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 
 [features]
 default = []
-sign = ["rand", "clap"]
+sign = ["rand08", "clap"]
 client = ["reqwest", "sha2", "tokio", "thiserror"]
 
 [dependencies]
@@ -38,7 +38,9 @@ mullvad-version = { path = "../mullvad-version", features = ["serde"] }
 
 # features required by binaries
 clap = { workspace = true, optional = true }
-rand = { version = "0.8.5", optional = true }
+# TODO Upgrading to rand 0.9 is blocked on ed25519-dalek dropping their dependency on rand_core 0.6
+# (as of ed25519-dalek 2.2.0)
+rand08 = { package = "rand", version = "0.8.5", optional = true }
 
 thiserror = { workspace = true, optional = true }
 
@@ -46,7 +48,7 @@ thiserror = { workspace = true, optional = true }
 async-tempfile = "0.6"
 insta = { workspace = true }
 mockito = "1.6.1"
-rand = "0.8.5"
+rand = { workspace = true }
 tokio = { workspace = true, features = ["fs", "test-util", "time", "macros"] }
 
 [[bin]]
diff --git a/mullvad-update/mullvad-release/Cargo.toml b/mullvad-update/mullvad-release/Cargo.toml
index efb5a11ba6..9c296f9eb3 100644
--- a/mullvad-update/mullvad-release/Cargo.toml
+++ b/mullvad-update/mullvad-release/Cargo.toml
@@ -15,7 +15,6 @@ anyhow = "1.0"
 chrono = { workspace = true, features = ["serde", "now"] }
 clap = { workspace = true }
 hex = { version = "0.4" }
-rand = { version = "0.8.5" }
 reqwest = { workspace = true }
 serde_json = { workspace = true }
 serde = { workspace = true }
diff --git a/mullvad-update/src/client/fetch.rs b/mullvad-update/src/client/fetch.rs
index dde38fdc76..dfc90a2b77 100644
--- a/mullvad-update/src/client/fetch.rs
+++ b/mullvad-update/src/client/fetch.rs
@@ -469,7 +469,7 @@ mod test {
     async fn test_fetch_complete() -> anyhow::Result<()> {
         // Generate random data
         let file_data = Box::leak(Box::new(vec![0u8; 1024 * 1024 + 1]));
-        rand::thread_rng().fill_bytes(file_data);
+        rand::rng().fill_bytes(file_data);
 
         // Start server
         let mut server = mockito::Server::new_async().await;
@@ -502,7 +502,7 @@ mod test {
     async fn test_fetch_interrupted() -> anyhow::Result<()> {
         // Generate random data
         let file_data = Box::leak(Box::new(vec![0u8; 1024 * 1024]));
-        rand::thread_rng().fill_bytes(file_data);
+        rand::rng().fill_bytes(file_data);
 
         // Start server
         let mut server = mockito::Server::new_async().await;
diff --git a/mullvad-update/src/client/verify.rs b/mullvad-update/src/client/verify.rs
index 28a53f839d..1242f5b6b1 100644
--- a/mullvad-update/src/client/verify.rs
+++ b/mullvad-update/src/client/verify.rs
@@ -70,7 +70,7 @@ mod test {
     async fn test_sha256_checksum() {
         // Generate some random data
         let mut data = vec![0u8; 1024 * 1024];
-        rand::thread_rng().fill_bytes(&mut data);
+        rand::rng().fill_bytes(&mut data);
 
         // Hash it
         let mut hasher = sha2::Sha256::new();
@@ -84,7 +84,7 @@ mod test {
             .expect("expected checksum match");
 
         // Compare the hash against some random data, which should fail
-        rand::thread_rng().fill_bytes(&mut data);
+        rand::rng().fill_bytes(&mut data);
         Sha256Verifier::verify_inner(Cursor::new(&data), expected_hash)
             .await
             .expect_err("expected checksum mismatch");
diff --git a/mullvad-update/src/format/key.rs b/mullvad-update/src/format/key.rs
index 93dd6ad7e1..d5b15f0ea2 100644
--- a/mullvad-update/src/format/key.rs
+++ b/mullvad-update/src/format/key.rs
@@ -16,7 +16,7 @@ impl SecretKey {
     /// Generate a new secret ed25519 key
     #[cfg(feature = "sign")]
     pub fn generate() -> Self {
-        let key = ed25519_dalek::SigningKey::generate(&mut rand::thread_rng());
+        let key = ed25519_dalek::SigningKey::generate(&mut rand08::thread_rng());
         SecretKey(key)
     }
 
@@ -175,7 +175,7 @@ mod test {
     #[test]
     fn test_serialization_and_deserialization() {
         let mut secret = [0u8; 32];
-        rand::thread_rng().fill_bytes(&mut secret);
+        rand::rng().fill_bytes(&mut secret);
 
         let secret_hex = hex::encode(secret);
         let secret = SecretKey::from_str(&hex::encode(secret)).unwrap();
diff --git a/talpid-core/Cargo.toml b/talpid-core/Cargo.toml
index d7303d9d7c..f2919169da 100644
--- a/talpid-core/Cargo.toml
+++ b/talpid-core/Cargo.toml
@@ -22,7 +22,7 @@ ipnetwork = { workspace = true }
 libc = "0.2"
 log = { workspace = true }
 parking_lot = "0.12.0"
-rand = "0.9.0"
+rand = { workspace = true }
 talpid-routing = { path = "../talpid-routing" }
 talpid-tunnel = { path = "../talpid-tunnel" }
 talpid-tunnel-config-client = { path = "../talpid-tunnel-config-client" }
diff --git a/talpid-future/Cargo.toml b/talpid-future/Cargo.toml
index 9baa0245d1..502c210a64 100644
--- a/talpid-future/Cargo.toml
+++ b/talpid-future/Cargo.toml
@@ -11,7 +11,7 @@ rust-version.workspace = true
 workspace = true
 
 [dependencies]
-rand = "0.8.5"
+rand = { workspace = true }
 talpid-time = { path = "../talpid-time" }
 
 [dev-dependencies]
diff --git a/talpid-future/src/retry.rs b/talpid-future/src/retry.rs
index def46d5bc2..6bc68174d6 100644
--- a/talpid-future/src/retry.rs
+++ b/talpid-future/src/retry.rs
@@ -1,5 +1,5 @@
 //! This library provides utility functions and types for retrying futures.
-use rand::{Rng, distributions::OpenClosed01};
+use rand::{Rng, distr::OpenClosed01};
 use std::{future::Future, ops::Deref, time::Duration};
 use talpid_time::sleep;
 
@@ -143,7 +143,7 @@ impl<I> Deref for Jittered<I> {
 
 /// Apply a jitter to a duration.
 fn jitter(dur: Duration) -> Duration {
-    apply_jitter(dur, rand::thread_rng().sample(OpenClosed01))
+    apply_jitter(dur, rand::rng().sample(OpenClosed01))
 }
 
 fn apply_jitter(duration: Duration, jitter: f64) -> Duration {
diff --git a/talpid-tunnel-config-client/Cargo.toml b/talpid-tunnel-config-client/Cargo.toml
index 42b8d777b0..a7290c3613 100644
--- a/talpid-tunnel-config-client/Cargo.toml
+++ b/talpid-tunnel-config-client/Cargo.toml
@@ -12,6 +12,7 @@ workspace = true
 
 [dependencies]
 log = { workspace = true }
+# Upgrading to rand 0.9 is blocked on ml-kem dropping their dependency on rand_core 0.6 (as of ml-kem 0.21)
 rand = "0.8"
 talpid-types = { path = "../talpid-types" }
 tonic = { workspace = true }
diff --git a/talpid-wireguard/Cargo.toml b/talpid-wireguard/Cargo.toml
index cf6e0f8acf..fb198c9502 100644
--- a/talpid-wireguard/Cargo.toml
+++ b/talpid-wireguard/Cargo.toml
@@ -30,9 +30,8 @@ zeroize = "1"
 chrono = { workspace = true, features = ["clock"] }
 tokio = { workspace = true, features = ["process", "rt-multi-thread", "fs"] }
 tunnel-obfuscation = { path = "../tunnel-obfuscation" }
-rand = "0.8.5"
+rand = { workspace = true }
 surge-ping = "0.8.0"
-rand_chacha = "0.3.1"
 wireguard-go-rs = { path = "../wireguard-go-rs" }
 tun07 = { package = "tun", version = "0.7.11", features = [
   "async",
@@ -67,6 +66,10 @@ bitflags = "1.2"
 talpid-windows = { path = "../talpid-windows" }
 widestring = "1.0"
 maybenot = "2.0.0"
+# TODO: rand 0.8 is a hard requirement of maybenot-ffi 2.0. May be upgraded to rand 0.9
+# when maybenot 2.2 is released.
+rand08 = { package = "rand", version = "0.8.5" }
+rand_chacha = "0.3.1"
 
 # TODO: Figure out which features are needed and which are not
 [target.'cfg(windows)'.dependencies.windows-sys]
diff --git a/talpid-wireguard/src/connectivity/pinger/icmp.rs b/talpid-wireguard/src/connectivity/pinger/icmp.rs
index 338f364844..590242c27c 100644
--- a/talpid-wireguard/src/connectivity/pinger/icmp.rs
+++ b/talpid-wireguard/src/connectivity/pinger/icmp.rs
@@ -170,7 +170,7 @@ impl PayloadWriter for Pinger {
     }
 
     fn write_payload(&mut self, buffer: &mut [u8]) {
-        rand::thread_rng().fill(buffer);
+        rand::rng().fill(buffer);
     }
 }
 
diff --git a/talpid-wireguard/src/mtu_detection.rs b/talpid-wireguard/src/mtu_detection.rs
index 98d4394437..04f7f36c41 100644
--- a/talpid-wireguard/src/mtu_detection.rs
+++ b/talpid-wireguard/src/mtu_detection.rs
@@ -239,7 +239,7 @@ mod tests {
     /// see <https://docs.rs/tokio/latest/tokio/time/fn.pause.html#auto-advance> for details.
     mod timeout {
         use super::*;
-        use rand::{distributions::Uniform, thread_rng};
+        use rand::{Rng, distr::Uniform};
         use std::pin::Pin;
         use tokio::test;
 
@@ -280,11 +280,10 @@ mod tests {
         /// order.
         #[test(start_paused = true)]
         async fn all_pings_ok() {
-            let mut rng = thread_rng();
             // Random delay for each ping, but within PING_OFFSET_TIMEOUT of the first
-            let uniform = Uniform::new(Duration::ZERO, PING_OFFSET_TIMEOUT);
+            let uniform = Uniform::new(Duration::ZERO, PING_OFFSET_TIMEOUT).unwrap();
             let pings = (0..=100)
-                .map(|p| delayed_ping(Ok(p), rng.sample(uniform)))
+                .map(|p| delayed_ping(Ok(p), rand::rng().sample(uniform)))
                 .collect();
             let max = max_ping_size(pings).await.unwrap();
             assert_eq!(max, 100);
@@ -310,15 +309,15 @@ mod tests {
         /// each other in time, the largest return value is chosen as normal.
         #[test(start_paused = true)]
         async fn delay_first_ping() {
-            let mut rng = thread_rng();
             // Random delay for each ping, but within PING_OFFSET_TIMEOUT of the first and no sooner
             // than 5s
             let uniform = Uniform::new(
                 Duration::from_secs(5),
                 Duration::from_secs(5) + PING_OFFSET_TIMEOUT,
-            );
+            )
+            .unwrap();
             let pings = (0..=100)
-                .map(|p| delayed_ping(Ok(p), rng.sample(uniform)))
+                .map(|p| delayed_ping(Ok(p), rand::rng().sample(uniform)))
                 .collect();
             let max = max_ping_size(pings).await.unwrap();
             assert_eq!(max, 100);
diff --git a/talpid-wireguard/src/wireguard_nt/daita.rs b/talpid-wireguard/src/wireguard_nt/daita.rs
index 9cf96852fd..a2c5d7e6c1 100644
--- a/talpid-wireguard/src/wireguard_nt/daita.rs
+++ b/talpid-wireguard/src/wireguard_nt/daita.rs
@@ -1,7 +1,7 @@
 use super::WIREGUARD_KEY_LENGTH;
 use maybenot::{MachineId, Timer};
 use once_cell::sync::OnceCell;
-use rand::{
+use rand08::{
     SeedableRng,
     rngs::{OsRng, adapter::ReseedingRng},
 };
diff --git a/test/Cargo.lock b/test/Cargo.lock
index 263e29b763..193de4c9ad 100644
--- a/test/Cargo.lock
+++ b/test/Cargo.lock
@@ -2171,7 +2171,7 @@ dependencies = [
  "itertools 0.14.0",
  "log",
  "mullvad-types",
- "rand 0.8.5",
+ "rand 0.9.1",
  "serde_json",
  "talpid-types",
  "thiserror 2.0.3",
@@ -3805,7 +3805,7 @@ dependencies = [
  "nix 0.30.1",
  "parity-tokio-ipc",
  "plist",
- "rand 0.8.5",
+ "rand 0.9.1",
  "rs-release",
  "serde",
  "serde_json",
diff --git a/test/Cargo.toml b/test/Cargo.toml
index 7b7b822d3d..fc89f94efd 100644
--- a/test/Cargo.toml
+++ b/test/Cargo.toml
@@ -85,3 +85,4 @@ async-trait = "0.1.58"
 socket2 = "0.5.7"
 surge-ping = "0.8"
 nix = { version = "0.30.1", features = ["ioctl", "socket", "net", "signal"] }
+rand = "0.9"
diff --git a/test/test-runner/Cargo.toml b/test/test-runner/Cargo.toml
index ad01aecbc8..8a1b22e776 100644
--- a/test/test-runner/Cargo.toml
+++ b/test/test-runner/Cargo.toml
@@ -24,7 +24,7 @@ serde = { workspace = true }
 serde_json = { workspace = true }
 tokio-serde = { workspace = true }
 surge-ping = { workspace = true }
-rand = "0.8"
+rand = { workspace = true }
 
 libc = "0.2"
 chrono = { workspace = true, features = ["serde"] }