diff --git a/Cargo.lock b/Cargo.lock
index 7bc58f342d560..2b90996920f30 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1618,7 +1618,7 @@ dependencies = [
  "hyper-rustls 0.27.5",
  "hyper-util",
  "pin-project-lite",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls 0.23.35",
  "rustls-native-certs 0.8.1",
  "rustls-pki-types",
@@ -7081,7 +7081,7 @@ dependencies = [
  "http 0.2.9",
  "hyper 0.14.27",
  "log",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls-native-certs 0.6.3",
  "tokio",
  "tokio-rustls 0.24.1",
@@ -7878,7 +7878,7 @@ dependencies = [
  "nom",
  "percent-encoding",
  "ring 0.16.20",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls-native-certs 0.6.3",
  "thiserror 1.0.63",
  "tokio",
@@ -8705,7 +8705,7 @@ dependencies = [
  "percent-encoding",
  "rand 0.8.5",
  "rustc_version_runtime",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls-pemfile 1.0.4",
  "serde",
  "serde_bytes",
@@ -10039,7 +10039,7 @@ dependencies = [
  "risingwave_common",
  "risingwave_sqlparser",
  "rsa",
- "rustls 0.21.11",
+ "rustls 0.23.35",
  "rustls-native-certs 0.6.3",
  "rustls-pemfile 1.0.4",
  "serde",
@@ -11453,7 +11453,7 @@ dependencies = [
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls-pemfile 1.0.4",
  "serde",
  "serde_json",
@@ -13801,9 +13801,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.21.11"
+version = "0.21.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fecbfb7b1444f477b345853b1fce097a2c6fb637b2bfb87e6bc5db0f043fae4"
+checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
 dependencies = [
  "log",
  "ring 0.17.13",
@@ -16030,7 +16030,7 @@ version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
 dependencies = [
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "tokio",
 ]
 
@@ -18141,7 +18141,7 @@ dependencies = [
  "itertools 0.10.5",
  "log",
  "percent-encoding",
- "rustls 0.21.11",
+ "rustls 0.21.12",
  "rustls-pemfile 1.0.4",
  "seahash",
  "serde",
diff --git a/src/utils/pgwire/Cargo.toml b/src/utils/pgwire/Cargo.toml
index e8b20c5926ea5..2017152d68bc4 100644
--- a/src/utils/pgwire/Cargo.toml
+++ b/src/utils/pgwire/Cargo.toml
@@ -24,7 +24,7 @@ postgres-types = { version = "0.2.6" }
 reqwest = "0.12.2"
 risingwave_common = { workspace = true }
 risingwave_sqlparser = { workspace = true }
-rustls = "0.21"
+rustls = "0.23"
 rustls-native-certs = "0.6.3"
 rustls-pemfile = "1.0"
 serde = { workspace = true }
diff --git a/src/utils/runtime/Cargo.toml b/src/utils/runtime/Cargo.toml
index f42cc08107e06..3bbc70edc55ae 100644
--- a/src/utils/runtime/Cargo.toml
+++ b/src/utils/runtime/Cargo.toml
@@ -22,7 +22,7 @@ pprof = { version = "0.15", features = ["flamegraph"] }
 risingwave_common = { workspace = true }
 risingwave_variables = { workspace = true }
 rlimit = "0.10"
-rustls = "0.23.5"
+rustls = "0.23.35"
 # Explicitly specify the tokio version used in RisingWave runtime
 rw-tokio = { version = "=1.47.2", package = "tokio" }
 thiserror-ext = { workspace = true }