diff --git a/Cargo.lock b/Cargo.lock
index 94c71eed..6df27a8a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6823,9 +6823,9 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "711e8c9646791c49b7eb799a19c4ae70a9b8372ddc6a1fa4778defd1e2aa5d5e"
 dependencies = [
  "crc32fast",
  "flate2",
diff --git a/crates/rustynes-frontend/Cargo.toml b/crates/rustynes-frontend/Cargo.toml
index f15eed88..33b3bf0f 100644
--- a/crates/rustynes-frontend/Cargo.toml
+++ b/crates/rustynes-frontend/Cargo.toml
@@ -337,7 +337,7 @@ png = "0.18"
 # so it reuses the already-present flate2 / miniz_oxide rather than pulling in
 # the AES / zstd / bzip2 extras. The wasm load path receives raw bytes from the
 # browser file picker, so it never needs zip.
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 
 # v1.8.5 — the HD-pack loader + compositor + HD audio moved to `rustynes-hdpack`
 # (so the mobile bridge can reach it; the core is no_std). The frontend re-exports
diff --git a/crates/rustynes-hdpack/Cargo.toml b/crates/rustynes-hdpack/Cargo.toml
index 65f439a9..a0a991ab 100644
--- a/crates/rustynes-hdpack/Cargo.toml
+++ b/crates/rustynes-hdpack/Cargo.toml
@@ -21,7 +21,7 @@ rustynes-ppu = { workspace = true, features = ["hd-pack"] }
 # Decode replacement tiles (png), load `.zip` packs (deflate only), and decode
 # HD-audio OGG tracks (lewton is pure-Rust, so it cross-compiles to Android).
 png = "0.18"
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 lewton = "0.10"
 
 [dev-dependencies]
diff --git a/crates/rustynes-mobile/Cargo.toml b/crates/rustynes-mobile/Cargo.toml
index 0efa62ea..9edd9d18 100644
--- a/crates/rustynes-mobile/Cargo.toml
+++ b/crates/rustynes-mobile/Cargo.toml
@@ -71,7 +71,7 @@ uniffi = { version = "0.32", features = ["cli"] }
 # v1.8.5 — accept still-compressed `.zip` ROMs (extract the first NES entry), the
 # same convenience the desktop has. `deflate` is the only codec real NES zips use;
 # default features off keeps bzip2/zstd/aes out of the mobile binary.
-zip = { version = "8", default-features = false, features = ["deflate"] }
+zip = { version = "9", default-features = false, features = ["deflate"] }
 
 [dev-dependencies]
 # v1.8.7 Phase B — the room-code loopback test stands up an in-process WebSocket
diff --git a/crates/rustynes-test-harness/Cargo.toml b/crates/rustynes-test-harness/Cargo.toml
index a15867af..d28941fc 100644
--- a/crates/rustynes-test-harness/Cargo.toml
+++ b/crates/rustynes-test-harness/Cargo.toml
@@ -79,7 +79,7 @@ png = { version = "0.18", optional = true }
 # `extract_rom_from_zip`. Native-only (the harness is never compiled for wasm);
 # `deflate`-only to match the frontend's feature set. `.7z` is handled via the
 # `7z` CLI (no Rust dep), matching `scripts/coverage/coverage.py`.
-zip = { version = "8", default-features = false, features = ["deflate"], optional = true }
+zip = { version = "9", default-features = false, features = ["deflate"], optional = true }
 
 [dev-dependencies]
 insta.workspace = true