diff --git a/Cargo.toml b/Cargo.toml
index cf8693850..9be02c109 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -176,19 +176,20 @@ serde_json = { version = "1.0.150", features = ["raw_value"] }
 serde_urlencoded = "0.7.1"
 
 # Cryptography and Security
-# NOTE: aes-gcm and chacha20poly1305 use RC versions because stable 0.11.0
-# has not been released yet. The previous stable versions (0.10.x) have
-# incompatible APIs. Monitor upstream for stable releases and upgrade promptly.
-aes-gcm = { version = "0.11.0-rc.4", features = ["rand_core"] }
-argon2 = { version = "0.6.0-rc.8" }
-blake2 = "0.11.0-rc.6"
-chacha20poly1305 = { version = "0.11.0-rc.3" }
+# NOTE: These direct cryptography dependencies use RC versions because the
+# matching stable releases are not available yet, while previous stable lines
+# have incompatible APIs. Keep them exact-pinned and monitor upstream for stable
+# releases.
+aes-gcm = { version = "=0.11.0-rc.4", features = ["rand_core"] }
+argon2 = { version = "=0.6.0-rc.8" }
+blake2 = "=0.11.0-rc.6"
+chacha20poly1305 = { version = "=0.11.0-rc.3" }
 crc-fast = "1.10.0"
 hmac = { version = "0.13.0" }
 jsonwebtoken = { version = "10.4.0", features = ["aws_lc_rs"] }
 openidconnect = { version = "4.0", default-features = false }
 pbkdf2 = "0.13.0"
-rsa = { version = "0.10.0-rc.18" }
+rsa = { version = "=0.10.0-rc.18" }
 rustls = { version = "0.23.41", default-features = false, features = ["aws-lc-rs", "logging", "tls12", "prefer-post-quantum", "std"] }
 rustls-native-certs = "0.8"
 rustls-pki-types = "1.14.1"