diff --git a/Cargo.lock b/Cargo.lock
index 3f51632936..57b796131e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7945,6 +7945,7 @@ dependencies = [
  "rsa",
  "rustix 0.38.37",
  "rustls 0.23.19",
+ "rustls-pki-types",
  "rustls-webpki 0.102.8",
  "schemars",
  "scopeguard",
@@ -10101,12 +10102,13 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.12.1"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48406db8ac1f3cbc7dcdb56ec355343817958a356ff430259bb07baf7607e1e1"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
  "pem",
  "ring",
+ "rustls-pki-types",
  "time",
  "yasna",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index a145a0bce4..1b3dc521fb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -618,7 +618,7 @@ rand_seeder = "0.3.0"
 range-requests = { path = "range-requests" }
 ratatui = "0.29.0"
 rayon = "1.10"
-rcgen = "0.12.1"
+rcgen = "0.13.2"
 reconfigurator-cli = { path = "dev-tools/reconfigurator-cli" }
 reedline = "0.38.0"
 ref-cast = "1.0"
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index 3f4b5f9b6d..81f2911b69 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -103,6 +103,7 @@ regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.12", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
 rustls = { version = "0.23.19", features = ["ring"] }
+rustls-pki-types = { version = "1.10.0", features = ["std"] }
 rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.22", features = ["bytes", "chrono", "semver", "uuid1"] }
 scopeguard = { version = "1.2.0" }
@@ -225,6 +226,7 @@ regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.12", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
 rustls = { version = "0.23.19", features = ["ring"] }
+rustls-pki-types = { version = "1.10.0", features = ["std"] }
 rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.22", features = ["bytes", "chrono", "semver", "uuid1"] }
 scopeguard = { version = "1.2.0" }