diff --git a/Cargo.lock b/Cargo.lock
index 94c0826736..2eee39d17f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1462,7 +1462,7 @@ dependencies = [
  "nix 0.29.0",
  "prctl",
  "priority-queue",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rmp-serde",
  "sendfd",
  "serde",
@@ -2858,7 +2858,7 @@ dependencies = [
  "nix 0.29.0",
  "pin-project",
  "proptest",
- "rand 0.8.5",
+ "rand 0.8.7",
  "regex",
  "regex-lite",
  "reqwest",
@@ -2919,7 +2919,7 @@ dependencies = [
  "os_info",
  "page_size",
  "portable-atomic",
- "rand 0.8.5",
+ "rand 0.8.7",
  "schemars",
  "serde",
  "serde_json",
@@ -2983,7 +2983,7 @@ dependencies = [
  "libdd-trace-stats",
  "libdd-trace-utils",
  "prost",
- "rand 0.8.5",
+ "rand 0.8.7",
  "regex",
  "rmp-serde",
  "serde",
@@ -3024,7 +3024,7 @@ dependencies = [
  "prost",
  "prost-build",
  "protoc-bin-vendored",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rand_chacha 0.3.1",
 ]
 
@@ -3183,7 +3183,7 @@ dependencies = [
  "libdd-trace-protobuf",
  "memfd",
  "prost",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rmp",
  "rmp-serde",
  "serde",
@@ -3285,7 +3285,7 @@ dependencies = [
  "parking_lot",
  "proptest",
  "prost",
- "rand 0.8.5",
+ "rand 0.8.7",
  "reqwest",
  "rustc-hash",
  "rustls",
@@ -3404,7 +3404,7 @@ dependencies = [
  "libdd-tuf",
  "manual_future",
  "prost",
- "rand 0.8.5",
+ "rand 0.8.7",
  "serde",
  "serde_json",
  "serde_with",
@@ -3528,7 +3528,7 @@ dependencies = [
  "criterion",
  "duplicate 0.4.1",
  "libdd-trace-protobuf",
- "rand 0.8.5",
+ "rand 0.8.7",
 ]
 
 [[package]]
@@ -3584,7 +3584,7 @@ dependencies = [
  "libdd-trace-obfuscation",
  "libdd-trace-protobuf",
  "libdd-trace-utils",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rmp-serde",
  "serde",
  "tokio",
@@ -3623,7 +3623,7 @@ dependencies = [
  "libdd-trace-protobuf",
  "libdd-trace-utils",
  "prost",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rmp",
  "rmp-serde",
  "rmpv",
@@ -4567,7 +4567,7 @@ dependencies = [
  "bitflags",
  "lazy_static",
  "num-traits",
- "rand 0.8.5",
+ "rand 0.8.7",
  "rand_chacha 0.3.1",
  "rand_xorshift",
  "regex-syntax",
@@ -4774,9 +4774,9 @@ checksum = "74765f6d916ee2faa39bc8e68e4f3ed8949b48cccdac59983d287a7cb71ce9c5"
 
 [[package]]
 name = "rand"
-version = "0.8.5"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+checksum = "22f6172bdec972074665ed81ed53b71da00bfc44b65a753cfde883ec4c702a1a"
 dependencies = [
  "libc",
  "rand_chacha 0.3.1",
diff --git a/datadog-sidecar/Cargo.toml b/datadog-sidecar/Cargo.toml
index dca1cf2d2e..7d98b600c9 100644
--- a/datadog-sidecar/Cargo.toml
+++ b/datadog-sidecar/Cargo.toml
@@ -46,7 +46,7 @@ http-body-util = "0.1"
 libdd-ipc = { path = "../libdd-ipc", features = ["tiny-bytes"] }
 libdd-ipc-macros = { path = "../libdd-ipc-macros" }
 
-rand = "0.8.3"
+rand = ">=0.8.6, <0.9"
 rmp-serde = "1.3.0"
 serde = { version = "1.0", features = ["derive", "rc"] }
 serde_with = "3.6.0"
diff --git a/deny.toml b/deny.toml
index 9f1fe0a0a9..7fab9ded02 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,5 +1,8 @@
 [advisories]
 unmaintained = "workspace"
+ignore = [
+  { id = "RUSTSEC-2026-0009", reason = "the fixed version requires rust >=1.88.0. TODO: remove this after bumping MSRV"}
+]
 
 [bans]
 multiple-versions = "warn"
diff --git a/libdd-common/Cargo.toml b/libdd-common/Cargo.toml
index b036c810d4..72f630b354 100644
--- a/libdd-common/Cargo.toml
+++ b/libdd-common/Cargo.toml
@@ -27,7 +27,7 @@ mime = { version = "0.3.16", optional = true }
 multer = { version = "3.1", optional = true }
 bytes = { version = "1.11.1" }
 pin-project = "1"
-rand = { version = "0.8", optional = true }
+rand = { version = ">=0.8.6, <0.9", optional = true }
 regex = "1.5"
 regex-lite = { version = "0.1", optional = true }
 # Use hickory-dns instead of the default system DNS resolver to avoid fork safety issues.
@@ -86,7 +86,7 @@ maplit = "1.0"
 mime = "0.3.16"
 multer = "3.1"
 proptest = "1"
-rand = "0.8"
+rand = ">=0.8.6, <0.9"
 tempfile.workspace = true
 tokio = { version = "1.23", features = ["rt", "macros", "time"] }
 
diff --git a/libdd-crashtracker/Cargo.toml b/libdd-crashtracker/Cargo.toml
index 918fe3a081..19835717d5 100644
--- a/libdd-crashtracker/Cargo.toml
+++ b/libdd-crashtracker/Cargo.toml
@@ -62,7 +62,7 @@ num-traits = "0.2.19"
 os_info = "3.14.0"
 page_size = "0.6.0"
 portable-atomic = { version = "1.6.0", features = ["serde"] }
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 schemars = "0.8.21"
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true, features = ["std"] }
diff --git a/libdd-data-pipeline/Cargo.toml b/libdd-data-pipeline/Cargo.toml
index d2351b1373..c96573d616 100644
--- a/libdd-data-pipeline/Cargo.toml
+++ b/libdd-data-pipeline/Cargo.toml
@@ -77,7 +77,7 @@ libdd-trace-utils = { path = "../libdd-trace-utils", features = [
 ] }
 httpmock = "0.8.0-alpha.1"
 prost = "0.14.1"
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 tempfile.workspace = true
 tokio = { version = "1.23", features = [
     "rt",
diff --git a/libdd-ddsketch/Cargo.toml b/libdd-ddsketch/Cargo.toml
index 84c533c9b8..da72c56cd5 100644
--- a/libdd-ddsketch/Cargo.toml
+++ b/libdd-ddsketch/Cargo.toml
@@ -20,7 +20,7 @@ protoc-bin-vendored = { workspace = true, optional = true }
 
 [dev-dependencies]
 criterion.workspace = true
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 rand_chacha = "0.3.1"
 
 [features]
diff --git a/libdd-library-config/Cargo.toml b/libdd-library-config/Cargo.toml
index 9d4508f3ec..19af7cecf0 100644
--- a/libdd-library-config/Cargo.toml
+++ b/libdd-library-config/Cargo.toml
@@ -25,7 +25,7 @@ serde = { workspace = true, features = ["derive"] }
 serde_yaml = "0.9.34"
 prost = "0.14.1"
 anyhow.workspace = true
-rand = "0.8.3"
+rand = ">=0.8.6, <0.9"
 rmp = "0.8.14"
 rmp-serde = "1.3.0"
 
diff --git a/libdd-profiling/Cargo.toml b/libdd-profiling/Cargo.toml
index 96f3ef87a0..51ce8289a0 100644
--- a/libdd-profiling/Cargo.toml
+++ b/libdd-profiling/Cargo.toml
@@ -47,7 +47,7 @@ libdd-profiling-protobuf = { version = "2.0.0", path = "../libdd-profiling-proto
 mime = "0.3.16"
 parking_lot = { version = "0.12", default-features = false }
 prost = "0.14.1"
-rand = "0.8"
+rand = ">=0.8.6, <0.9"
 # Use rustls to align with the rest of the workspace (libdd-common, libdd-telemetry, etc.)
 # Non-FIPS builds use ring as the crypto provider; FIPS builds use aws-lc-rs.
 # Use hickory-dns instead of the default system DNS resolver to avoid fork safety issues.
diff --git a/libdd-trace-normalization/Cargo.toml b/libdd-trace-normalization/Cargo.toml
index 00b330d531..f4084bd7dc 100644
--- a/libdd-trace-normalization/Cargo.toml
+++ b/libdd-trace-normalization/Cargo.toml
@@ -21,7 +21,7 @@ arbitrary = { version = "1.3", features = ["derive"], optional = true }
 fuzzing = ["arbitrary"]
 
 [dev-dependencies]
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 duplicate = "0.4.1"
 criterion.workspace = true
 
diff --git a/libdd-trace-stats/Cargo.toml b/libdd-trace-stats/Cargo.toml
index 92f2bd6116..bace27b709 100644
--- a/libdd-trace-stats/Cargo.toml
+++ b/libdd-trace-stats/Cargo.toml
@@ -48,7 +48,7 @@ path = "benches/main.rs"
 criterion.workspace = true
 httpmock = "0.8.0-alpha.1"
 libdd-trace-utils = { path = "../libdd-trace-utils", features = ["test-utils"] }
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 tokio = { version = "1.23", features = ["rt-multi-thread", "macros", "test-util", "time"], default-features = false }
 
 [features]
diff --git a/libdd-trace-utils/Cargo.toml b/libdd-trace-utils/Cargo.toml
index 520cb08c80..91213810de 100644
--- a/libdd-trace-utils/Cargo.toml
+++ b/libdd-trace-utils/Cargo.toml
@@ -40,7 +40,7 @@ serde_json = { workspace = true, features = ["std"] }
 serde-transcode = "1.1"
 futures.workspace = true
 tokio = { workspace = true, features = ["macros"] }
-rand = "0.8.5"
+rand = ">=0.8.6, <0.9"
 bytes = "1.11.1"
 rmpv = { version = "1.3.0", default-features = false }
 rmp = { version = "0.8.14", default-features = false }