diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 6da4ff7a..f2cf25d3 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -103,8 +103,8 @@ catalogs:
       specifier: ^4.1.1
       version: 4.1.1
     jsonwebtoken:
-      specifier: ^9.0.2
-      version: 9.0.2
+      specifier: ^9.0.3
+      version: 9.0.3
     langchain:
       specifier: ^1.0.1
       version: 1.0.6
@@ -386,7 +386,7 @@ importers:
         version: 1.1.0-alpha.85
       jsonwebtoken:
         specifier: 'catalog:'
-        version: 9.0.2
+        version: 9.0.3
     devDependencies:
       '@eslint/js':
         specifier: 'catalog:'
@@ -3043,9 +3043,16 @@ packages:
     resolution: {integrity: sha512-PRp66vJ865SSqOlgqS8hujT5U4AOgMfhrwYIuIhfKaoSCZcirrmASQr8CX7cUg+RMih+hgznrjp99o+W4pJLHQ==}
     engines: {node: '>=12', npm: '>=6'}
 
+  jsonwebtoken@9.0.3:
+    resolution: {integrity: sha512-MT/xP0CrubFRNLNKvxJ2BYfy53Zkm++5bX9dtuPbqAeQpTVe0MQTFhao8+Cp//EmJp244xt6Drw/GVEGCUj40g==}
+    engines: {node: '>=12', npm: '>=6'}
+
   jwa@1.4.2:
     resolution: {integrity: sha512-eeH5JO+21J78qMvTIDdBXidBd6nG2kZjg5Ohz/1fpa28Z4CcsWUzJ1ZZyFq/3z3N17aZy+ZuBoHljASbL1WfOw==}
 
+  jwa@2.0.1:
+    resolution: {integrity: sha512-hRF04fqJIP8Abbkq5NKGN0Bbr3JxlQ+qhZufXVr0DvujKy93ZCbXZMHDL4EOtodSbCWxOqR8MS1tXA5hwqCXDg==}
+
   jwks-rsa@3.2.0:
     resolution: {integrity: sha512-PwchfHcQK/5PSydeKCs1ylNym0w/SSv8a62DgHJ//7x2ZclCoinlsjAfDxAAbpoTPybOum/Jgy+vkvMmKz89Ww==}
     engines: {node: '>=14'}
@@ -3053,6 +3060,9 @@ packages:
   jws@3.2.2:
     resolution: {integrity: sha512-YHlZCB6lMTllWDtSPHz/ZXTsi8S00usEV6v1tjq8tOUZzw7DpSDWVXjXDre6ed1w/pd495ODpHZYSdkRTsa0HA==}
 
+  jws@4.0.1:
+    resolution: {integrity: sha512-EKI/M/yqPncGUUh44xz0PxSidXFr/+r0pA70+gIYhjv+et7yxM+s29Y+VGDkovRofQem0fs7Uvf4+YmAdyRduA==}
+
   keyv@4.5.4:
     resolution: {integrity: sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==}
 
@@ -6712,12 +6722,31 @@ snapshots:
       ms: 2.1.3
       semver: 7.7.3
 
+  jsonwebtoken@9.0.3:
+    dependencies:
+      jws: 4.0.1
+      lodash.includes: 4.3.0
+      lodash.isboolean: 3.0.3
+      lodash.isinteger: 4.0.4
+      lodash.isnumber: 3.0.3
+      lodash.isplainobject: 4.0.6
+      lodash.isstring: 4.0.1
+      lodash.once: 4.1.1
+      ms: 2.1.3
+      semver: 7.7.3
+
   jwa@1.4.2:
     dependencies:
       buffer-equal-constant-time: 1.0.1
       ecdsa-sig-formatter: 1.0.11
       safe-buffer: 5.2.1
 
+  jwa@2.0.1:
+    dependencies:
+      buffer-equal-constant-time: 1.0.1
+      ecdsa-sig-formatter: 1.0.11
+      safe-buffer: 5.2.1
+
   jwks-rsa@3.2.0:
     dependencies:
       '@types/express': 4.17.25
@@ -6734,6 +6763,11 @@ snapshots:
       jwa: 1.4.2
       safe-buffer: 5.2.1
 
+  jws@4.0.1:
+    dependencies:
+      jwa: 2.0.1
+      safe-buffer: 5.2.1
+
   keyv@4.5.4:
     dependencies:
       json-buffer: 3.0.1
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 1a03f925..b8896de4 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -15,7 +15,7 @@ catalog:
   "express": "^5.2.0"
 
   # JSON Web Token
-  "jsonwebtoken": "^9.0.2"
+  "jsonwebtoken": "^9.0.3"
 
   # LangChain packages - use latest stable
   "langchain": "^1.0.1"
diff --git a/tests/__mocks__/jsonwebtoken.ts b/tests/__mocks__/jsonwebtoken.ts
new file mode 100644
index 00000000..ed64f7c8
--- /dev/null
+++ b/tests/__mocks__/jsonwebtoken.ts
@@ -0,0 +1,14 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT License.
+
+/**
+ * Manual mock for jsonwebtoken module
+ */
+
+const jwt = {
+  decode: jest.fn(),
+  sign: jest.fn(),
+  verify: jest.fn(),
+};
+
+module.exports = jwt;
diff --git a/tests/runtime/utility.test.ts b/tests/runtime/utility.test.ts
index db046b96..0158544e 100644
--- a/tests/runtime/utility.test.ts
+++ b/tests/runtime/utility.test.ts
@@ -4,6 +4,7 @@
 import { describe, it, expect, jest, beforeEach } from '@jest/globals';
 import * as jwt from 'jsonwebtoken';
 
+// Mock jsonwebtoken module
 jest.mock('jsonwebtoken');
 
 import { Utility } from '@microsoft/agents-a365-runtime';
@@ -66,6 +67,7 @@ describe('Utility', () => {
     let mockContext: jest.Mocked<TurnContext>;
 
     beforeEach(() => {
+      jest.clearAllMocks();
       mockContext = {
         activity: {
           isAgenticRequest: jest.fn(),