diff --git a/Cargo.lock b/Cargo.lock
index baa6502..e0b9986 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3663,7 +3663,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tower",
- "tower-http",
+ "tower-http 0.7.0",
  "tracing",
  "ulid",
  "uuid",
@@ -4250,7 +4250,7 @@ dependencies = [
  "tokio-rustls",
  "tokio-util",
  "tower",
- "tower-http",
+ "tower-http 0.6.11",
  "tower-service",
  "url",
  "wasm-bindgen",
@@ -5875,6 +5875,24 @@ name = "tower-http"
 version = "0.6.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
+dependencies = [
+ "bitflags 2.11.0",
+ "bytes",
+ "futures-util",
+ "http",
+ "http-body",
+ "pin-project-lite",
+ "tower",
+ "tower-layer",
+ "tower-service",
+ "url",
+]
+
+[[package]]
+name = "tower-http"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b11f75e912b0c2be01b63d8cf8057b8c3f97cf34abb3d431a3a4c8675498e233"
 dependencies = [
  "async-compression",
  "bitflags 2.11.0",
@@ -5892,11 +5910,9 @@ dependencies = [
  "pin-project-lite",
  "tokio",
  "tokio-util",
- "tower",
  "tower-layer",
  "tower-service",
  "tracing",
- "url",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index f6f9808..551a96c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,7 +65,7 @@ tokio           = { version = "1", features = ["full"] }
 # ── HTTP server ────────────────────────────────────────────────────────────────
 axum            = { version = "0.8", features = ["ws"] }
 tower           = "0.5"
-tower-http = { version = "0.6", features = [
+tower-http = { version = "0.7", features = [
   "trace",
   "cors",
   "compression-full",
diff --git a/crates/paroche/Cargo.toml b/crates/paroche/Cargo.toml
index 5016b69..3869ad4 100644
--- a/crates/paroche/Cargo.toml
+++ b/crates/paroche/Cargo.toml
@@ -16,7 +16,7 @@ epignosis.workspace = true
 kritike.workspace = true
 axum.workspace = true
 tower.workspace = true
-tower-http = { version = "0.6", features = [
+tower-http = { version = "0.7", features = [
   "trace",
   "cors",
   "compression-full",