diff --git a/Cargo.lock b/Cargo.lock
index e55986b..87621a6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1145,7 +1145,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2282,7 +2282,7 @@ version = "5.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "51e219e79014df21a225b1860a479e2dcd7cbd9130f4defd4bd0e191ea31d67d"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
  "http",
@@ -2824,7 +2824,7 @@ dependencies = [
  "once_cell",
  "socket2",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3142,9 +3142,9 @@ dependencies = [
 
 [[package]]
 name = "russh"
-version = "0.62.7"
+version = "0.63.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9decb68e4e44e1079700e54f17c8f23806ec53d7e0db73ab1c71d9dabc666812"
+checksum = "35bab1b87d915817d5d9cc352637cd40d5f0b298a48c6309af9156a4addc3031"
 dependencies = [
  "aes",
  "aws-lc-rs",
@@ -4517,9 +4517,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "uuid"
-version = "1.24.1"
+version = "1.25.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+checksum = "f053576934f05a761a402421fbbe3d425d9366f75f978806a037b3ca481abecc"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",
diff --git a/Cargo.toml b/Cargo.toml
index f569997..777080c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -76,7 +76,7 @@ reqwest = { version = "0.12", features = ["json", "rustls-tls-native-roots"], de
 webpki-roots = "1"
 
 # SSH tunneling (jump host / bastion)
-russh = "0.62"
+russh = "0.63"
 
 # Docker (VDI container management)
 bollard = "0.21"
diff --git a/src/tunnel.rs b/src/tunnel.rs
index 652c91e..80ed3e8 100644
--- a/src/tunnel.rs
+++ b/src/tunnel.rs
@@ -9,7 +9,7 @@
 
 use russh::client;
 use russh::keys::key::PrivateKeyWithHashAlg;
-use russh::keys::{HashAlg, PublicKey};
+use russh::keys::{HashAlg, PublicKeyOrCertificate};
 use serde::{Deserialize, Serialize};
 use std::net::SocketAddr;
 use std::sync::Arc;
@@ -128,8 +128,10 @@ impl client::Handler for TunnelHandler {
 
     async fn check_server_key(
         &mut self,
-        server_public_key: &PublicKey,
+        server_public_key: &PublicKeyOrCertificate,
     ) -> Result<bool, Self::Error> {
+        // russh 0.63 hands the callback a key-or-certificate; resolve to the key.
+        let server_public_key = server_public_key.public_key();
         let fingerprint = server_public_key.fingerprint(HashAlg::Sha256);
         let algorithm = server_public_key.algorithm();
 
@@ -162,7 +164,7 @@ impl client::Handler for TunnelHandler {
             }
         };
 
-        if *server_public_key == expected_pubkey {
+        if server_public_key == expected_pubkey {
             tracing::debug!(
                 hop = self.hop_index,
                 host = %self.jump_host,
@@ -196,8 +198,10 @@ impl client::Handler for ProbeHandler {
 
     async fn check_server_key(
         &mut self,
-        server_public_key: &PublicKey,
+        server_public_key: &PublicKeyOrCertificate,
     ) -> Result<bool, Self::Error> {
+        // russh 0.63 hands the callback a key-or-certificate; resolve to the key.
+        let server_public_key = server_public_key.public_key();
         let openssh = server_public_key
             .to_openssh()
             .map_err(|e| russh::Error::Keys(russh::keys::Error::SshKey(e)))?;