diff --git a/Cargo.lock b/Cargo.lock
index d487623294..94ee851f56 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -198,7 +198,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
 dependencies = [
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -209,7 +209,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
 dependencies = [
  "anstyle",
  "once_cell_polyfill",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1522,7 +1522,24 @@ dependencies = [
  "cpufeatures 0.2.17",
  "curve25519-dalek-derive",
  "digest 0.10.7",
- "fiat-crypto",
+ "fiat-crypto 0.2.9",
+ "rustc_version",
+ "subtle",
+ "zeroize",
+]
+
+[[package]]
+name = "curve25519-dalek"
+version = "5.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5eed333089e2e1c1ac8c6c0398e5e2497b4c9926ca6d0365ed1e099afa5bc23"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "curve25519-dalek-derive",
+ "digest 0.11.3",
+ "fiat-crypto 0.3.0",
+ "rand_core 0.10.1",
  "rustc_version",
  "subtle",
  "zeroize",
@@ -1788,7 +1805,7 @@ dependencies = [
  "libc",
  "option-ext",
  "redox_users",
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1902,21 +1919,44 @@ dependencies = [
  "signature 2.2.0",
 ]
 
+[[package]]
+name = "ed25519"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29fcf32e6c73d1079f83ab4d782de2d81620346a5f38c6237a86a22f8368980a"
+dependencies = [
+ "signature 3.0.0",
+]
+
 [[package]]
 name = "ed25519-dalek"
 version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
- "curve25519-dalek",
- "ed25519",
- "rand_core 0.6.4",
+ "curve25519-dalek 4.1.3",
+ "ed25519 2.2.3",
  "serde",
  "sha2 0.10.9",
  "subtle",
  "zeroize",
 ]
 
+[[package]]
+name = "ed25519-dalek"
+version = "3.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ebaa1a2bf1290ab3bfe5a7b771d050ebffab2711c19a81691c683a5144a25de"
+dependencies = [
+ "curve25519-dalek 5.0.0",
+ "ed25519 3.0.0",
+ "rand_core 0.10.1",
+ "sha2 0.11.0",
+ "signature 3.0.0",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "ed448"
 version = "0.5.0"
@@ -2105,7 +2145,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2215,6 +2255,12 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "fiat-crypto"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "64cd1e32ddd350061ae6edb1b082d7c54915b5c672c389143b9a63403a109f24"
+
 [[package]]
 name = "field-offset"
 version = "0.3.6"
@@ -2629,7 +2675,7 @@ dependencies = [
  "gobject-sys 0.22.6",
  "libc",
  "system-deps",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3831,7 +3877,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46"
 dependencies = [
  "hermit-abi",
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -3986,7 +4032,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "881733cbc631fc9e472e24447ce32a64bedf2da498d6d8570b08edc87de71f65"
 dependencies = [
  "base64 0.22.1",
- "ed25519-dalek",
+ "ed25519-dalek 2.2.0",
  "getrandom 0.2.17",
  "hmac 0.12.1",
  "js-sys",
@@ -4819,7 +4865,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.59.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -5457,7 +5503,7 @@ dependencies = [
  "dialoguer 0.12.0",
  "dirs",
  "dotenvy",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0",
  "env_logger",
  "flate2",
  "fslock",
@@ -6075,7 +6121,7 @@ dependencies = [
  "ctr",
  "dashmap 6.2.1",
  "ecb 0.2.1",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0",
  "ed448-goldilocks",
  "flate2",
  "ghash 0.6.0",
@@ -6363,7 +6409,7 @@ version = "0.5.1641"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
- "ed25519-dalek",
+ "ed25519-dalek 3.0.0",
  "hex",
  "perry-runtime",
  "semver",
@@ -7364,7 +7410,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -7995,7 +8041,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c3d1e2c7f27f8d4cb10542a02c49005dbd6e93095799d6f3be745fae9f8fedd4"
 dependencies = [
  "libc",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8084,7 +8130,7 @@ dependencies = [
  "cfg-if",
  "libc",
  "psm",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -8700,7 +8746,7 @@ dependencies = [
  "getrandom 0.4.3",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9350,7 +9396,7 @@ checksum = "f2f6fb2847f6742cd76af783a2a2c49e9375d0a111c7bef6f71cd9e738c72d6e"
 dependencies = [
  "memoffset",
  "tempfile",
- "windows-sys 0.60.2",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -9884,7 +9930,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.48.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -10447,7 +10493,7 @@ version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7e468321c81fb07fa7f4c636c3972b9100f0346e5b6a9f2bd0603a52f7ed277"
 dependencies = [
- "curve25519-dalek",
+ "curve25519-dalek 4.1.3",
  "rand_core 0.6.4",
  "serde",
  "zeroize",
diff --git a/changelog.d/11064-ed25519-dalek-3.md b/changelog.d/11064-ed25519-dalek-3.md
new file mode 100644
index 0000000000..2260b07cd2
--- /dev/null
+++ b/changelog.d/11064-ed25519-dalek-3.md
@@ -0,0 +1,11 @@
+Bumped `ed25519-dalek` 2.2.0 → 3.0.0 (dependabot) in `perry`, `perry-stdlib`, and
+`perry-updater`. The major bump pulls in `curve25519-dalek` 5.0.0, `sha2` 0.11.0,
+`rand_core` 0.10.1, and a matching `ed25519` 3.0.0, but leaves the surface Perry
+actually touches unchanged: `SigningKey`/`VerifyingKey::from_bytes`,
+`Signature::from_bytes`/`try_from`, and the `Signer`/`Verifier` trait methods
+used in `crates/perry-stdlib/src/crypto/`, `crates/perry-stdlib/src/webcrypto/`,
+`crates/perry-updater/src/{cli_manifest,core}.rs`, and
+`crates/perry/src/commands/updater.rs` all kept their existing signatures, so
+none of those call sites needed to change. `jsonwebtoken` (an indirect,
+optional-feature consumer) stays pinned on `ed25519-dalek` 2.2.0, so both major
+versions coexist in the lockfile without conflict.
diff --git a/crates/perry-stdlib/Cargo.toml b/crates/perry-stdlib/Cargo.toml
index cd8ee26176..32ecb05982 100644
--- a/crates/perry-stdlib/Cargo.toml
+++ b/crates/perry-stdlib/Cargo.toml
@@ -385,7 +385,7 @@ argon2 = { version = "0.5", optional = true }
 base64 = { workspace = true, optional = true }
 x25519-dalek = { version = "2.0", features = ["static_secrets"], optional = true }
 x448 = { version = "0.14.0-pre.9", features = ["static_secrets"], optional = true }
-ed25519-dalek = { version = "2.1", optional = true }
+ed25519-dalek = { version = "3.0", optional = true }
 ed448-goldilocks = { version = "0.14.0-pre.13", default-features = false, features = ["alloc", "signing"], optional = true }
 aes-gcm = { version = "0.10", optional = true }
 chacha20poly1305 = { version = "0.10", optional = true }
diff --git a/crates/perry-updater/Cargo.toml b/crates/perry-updater/Cargo.toml
index 7dc6a323de..14bc8eceb6 100644
--- a/crates/perry-updater/Cargo.toml
+++ b/crates/perry-updater/Cargo.toml
@@ -19,7 +19,7 @@ semver.workspace = true
 sha2 = "0.11"
 hex.workspace = true
 base64.workspace = true
-ed25519-dalek = "2.1"
+ed25519-dalek = "3.0"
 
 [dev-dependencies]
 tempfile.workspace = true
diff --git a/crates/perry/Cargo.toml b/crates/perry/Cargo.toml
index 7720c8e8ec..631f1691f5 100644
--- a/crates/perry/Cargo.toml
+++ b/crates/perry/Cargo.toml
@@ -99,7 +99,7 @@ fslock = "0.2"
 # feature — listing them as direct deps just makes them callable from
 # the CLI module. ed25519-dalek 2.1 takes any CryptoRng; we use rand 0.9
 # for the keygen seed.
-ed25519-dalek = { version = "2.1", features = ["rand_core"], optional = true }
+ed25519-dalek = { version = "3.0", features = ["rand_core"], optional = true }
 sha2 = "0.11"
 hex.workspace = true
 rand = { version = "0.10", optional = true }