diff --git a/Cargo.lock b/Cargo.lock
index f5f47e3..e058e9e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1168,7 +1168,7 @@ dependencies = [
 name = "tinybrowser"
 version = "0.2.1"
 dependencies = [
- "base64 0.22.1",
+ "base64 0.23.1",
  "futures-util",
  "reqwest",
  "serde",
diff --git a/crates/tinybrowser/Cargo.toml b/crates/tinybrowser/Cargo.toml
index fc9fc23..bd5ce2c 100644
--- a/crates/tinybrowser/Cargo.toml
+++ b/crates/tinybrowser/Cargo.toml
@@ -46,7 +46,7 @@ futures-util = { version = "0.3", default-features = false, features = ["sink",
 reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls-webpki-roots"] }
 # Screenshots cross the bus as base64 inside a JSON frame, and CDP hands them
 # over base64-encoded already.
-base64 = "0.22"
+base64 = "0.23"
 # Held screenshot outputs are addressed by an unguessable id.
 uuid = { version = "1", features = ["v4"] }
 # Held outputs are digested so a host can verify what it reassembled.
@@ -59,7 +59,7 @@ url = "2"
 # The GitHub release verifier passes an explicit empty module configuration.
 serde_json = { workspace = true }
 # The live suite reassembles a held screenshot to check it round trips.
-base64 = "0.22"
+base64 = "0.23"
 # The CDP client's own tests stand up a WebSocket server in place of a browser,
 # which is the only way to exercise what happens when one misbehaves: a protocol
 # error, a command that is never answered, a socket that closes mid-call.