diff --git a/Cargo.lock b/Cargo.lock
index fb34e040..313643fd 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1345,9 +1345,9 @@ checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
 [[package]]
 name = "libloading"
-version = "0.8.9"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7c4b02199fee7c5d21a5ae7d8cfa79a6ef5bb2fc834d6e9058e89c825efdc55"
+checksum = "754ca22de805bb5744484a5b151a9e1a8e837d5dc232c2d7d8c2e3492edc8b60"
 dependencies = [
  "cfg-if",
  "windows-link",
diff --git a/crates/plugin-loader/Cargo.toml b/crates/plugin-loader/Cargo.toml
index bdeba815..545e97ee 100644
--- a/crates/plugin-loader/Cargo.toml
+++ b/crates/plugin-loader/Cargo.toml
@@ -11,7 +11,7 @@ license = "Apache-2.0"
 busbar-api = { path = "../api" }
 busbar-plugin-abi = { path = "../plugin-abi" }
 busbar-plugin-sign = { path = "../plugin-sign" }
-libloading = "0.8"
+libloading = "0.9"
 # The kind:hook seam: `DlopenPolicy` implements the async `busbar_api::RoutingPolicy` trait, running
 # the blocking `busbar_call` on `spawn_blocking` (a hook gate can be CPU-heavy). `async-trait` matches
 # the engine's; `tokio` is `rt`/`time`/`sync` only (spawn_blocking, timeout, the hook-call semaphore)