diff --git a/Cargo.lock b/Cargo.lock
index 02a3023..1fa7219 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -559,6 +559,26 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bincode"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "36eaf5d7b090263e8150820482d5d93cd964a81e4019913c972f4edcc6edb740"
+dependencies = [
+ "bincode_derive",
+ "serde",
+ "unty",
+]
+
+[[package]]
+name = "bincode_derive"
+version = "2.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf95709a440f45e986983918d0e8a1f30a9b1df04918fc828670606804ac3c09"
+dependencies = [
+ "virtue",
+]
+
 [[package]]
 name = "bindgen"
 version = "0.59.2"
@@ -900,7 +920,7 @@ dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
- "bincode",
+ "bincode 2.0.1",
  "blake3",
  "bytes",
  "common",
@@ -2005,7 +2025,7 @@ name = "federation"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bincode",
+ "bincode 2.0.1",
  "blake3",
  "capsule-registry",
  "common",
@@ -2087,7 +2107,7 @@ name = "foundry"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bincode",
+ "bincode 2.0.1",
  "bytes",
  "capsule-registry",
  "common",
@@ -2538,7 +2558,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "085f262d7604911c8150162529cefab3782e91adb20202e8658f7275d2aefe5d"
 dependencies = [
- "bincode",
+ "bincode 1.3.3",
  "futures",
  "gloo-utils",
  "gloo-worker-macros",
@@ -2569,7 +2589,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bincode",
+ "bincode 2.0.1",
  "bytes",
  "futures",
  "hmac",
@@ -6151,7 +6171,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "bincode",
+ "bincode 2.0.1",
  "blake3",
  "bytes",
  "common",
@@ -6260,9 +6280,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
 dependencies = [
  "serde_core",
  "serde_derive",
@@ -6281,35 +6301,35 @@ dependencies = [
 
 [[package]]
 name = "serde_core"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.228"
+version = "1.0.229"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 2.0.111",
+ "syn 3.0.5",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.145"
+version = "1.0.151"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "402a6f66d8c709116cf22f558eab210f5a50187f702eb4d7e5ef38d9a7f1c79c"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
 dependencies = [
  "itoa",
  "memchr",
- "ryu",
  "serde",
  "serde_core",
+ "zmij",
 ]
 
 [[package]]
@@ -6952,6 +6972,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12df2e0110f65b775f769bb17ef989067a1d931b2eb822bd4346631eeada89f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn_derive"
 version = "0.1.8"
@@ -7941,6 +7972,12 @@ version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"
 
+[[package]]
+name = "unty"
+version = "0.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d49784317cd0d1ee7ec5c716dd598ec5b4483ea832a2dced265471cc0f690ae"
+
 [[package]]
 name = "ureq"
 version = "2.12.1"
@@ -8107,6 +8144,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "virtue"
+version = "0.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "051eb1abcf10076295e815102942cc58f9d5e3b4560e46e53c21e8ff6f3af7b1"
+
 [[package]]
 name = "void"
 version = "1.0.2"
@@ -9338,6 +9381,12 @@ dependencies = [
  "zopfli",
 ]
 
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"
+
 [[package]]
 name = "zopfli"
 version = "0.8.3"
diff --git a/Cargo.toml b/Cargo.toml
index d24fb7b..526ccb1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,8 +65,8 @@ time = { version = "^0.3.36", features = ["macros", "formatting"] } # 2025-11-03
 semver = { version = "^1.0.27" } # 2025-11-03 sw: version range evaluation for drift detection
 
 # Tier 0 — cryptography, serialization, dedup core (2025-11-03 sw; see docs/dependency-security.md#tier-0)
-serde = { version = "=1.0.228", features = ["derive"] } # 2025-11-03 sw: canonical serialization; CT reviewed
-serde_json = { version = "=1.0.145" } # 2025-11-03 sw: deterministic JSON for protocol surfaces
+serde = { version = "=1.0.229", features = ["derive"] } # 2025-11-03 sw: canonical serialization; CT reviewed
+serde_json = { version = "=1.0.151" } # 2025-11-03 sw: deterministic JSON for protocol surfaces
 serde_yaml = { version = "0.9" } # YAML parsing for CLI policies
 blake3 = { version = "=1.8.3" } # 2025-11-03 sw: convergent hash, SIMD constant-time per upstream audit
 bloomfilter = { version = "=1.0.13" } # 2025-11-03 sw: dedupe candidate screening, bounded memory
@@ -98,7 +98,7 @@ libp2p-tcp = { version = "=0.41.0", default-features = false, features = ["tokio
 libp2p-noise = { version = "=0.44.0" } # 2025-11-16 sw: Noise handshake
 libp2p-yamux = { version = "=0.45.2" } # 2025-11-16 sw: Yamux multiplexer
 multiaddr = { version = "=0.18.2" } # 2025-11-16 sw: Multiaddr /ip4/... format
-bincode = { version = "=1.3.3" } # 2025-11-16 sw: Binary serialization for gossip messages
+bincode = { version = "=2.0.1" } # 2025-11-16 sw: Binary serialization for gossip messages
 bytes = { version = "^1.10.1" } # 2025-11-16 sw: Zero-copy byte buffers
 rand = { version = "=0.8.6" } # 2026-05-08 sw: Random peer selection for gossip; includes RUSTSEC-2026-0097 fix
 backoff = { version = "=0.4.0" } # 2025-11-16 sw: Retry logic with exponential backoff
diff --git a/crates/foundry/Cargo.toml b/crates/foundry/Cargo.toml
index cf09154..a60589e 100644
--- a/crates/foundry/Cargo.toml
+++ b/crates/foundry/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 anyhow = { workspace = true }
-bincode = "1.3"
+bincode = "2.0"
 bytes = { workspace = true }
 dashmap = "5.5.3"
 futures = { workspace = true }
diff --git a/crates/scaling/Cargo.toml b/crates/scaling/Cargo.toml
index 941b8b5..acaefc3 100644
--- a/crates/scaling/Cargo.toml
+++ b/crates/scaling/Cargo.toml
@@ -23,7 +23,7 @@ futures = { workspace = true }
 raft-rs = { workspace = true, optional = true }
 bytes = "1"
 blake3 = { workspace = true }
-bincode = "1"
+bincode = "2"
 hex = "0.4"
 socket2 = { version = "0.5", features = ["all"] }
 dashmap = "5"