diff --git a/Cargo.lock b/Cargo.lock
index a9fa17fd24c..4214c6dc279 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1092,7 +1092,7 @@ dependencies = [
  "paste",
  "postgres-native-tls",
  "prometheus",
- "rand 0.8.5",
+ "rand 0.9.0",
  "regex",
  "reqwest",
  "rss",
@@ -1270,7 +1270,7 @@ dependencies = [
  "bytes",
  "clap",
  "crates_io_index",
- "rand 0.8.5",
+ "rand 0.9.0",
  "reqwest",
  "secrecy",
  "semver",
@@ -1328,7 +1328,7 @@ dependencies = [
  "diesel",
  "diesel-async",
  "diesel_migrations",
- "rand 0.8.5",
+ "rand 0.9.0",
  "tracing",
  "url",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 0ec22459ed4..d951a40d985 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -102,7 +102,7 @@ parking_lot = "=0.12.3"
 paste = "=1.0.15"
 postgres-native-tls = "=0.5.1"
 prometheus = { version = "=0.13.4", default-features = false }
-rand = "=0.8.5"
+rand = "=0.9.0"
 reqwest = { version = "=0.12.12", features = ["gzip", "json"] }
 rss = { version = "=2.0.11", default-features = false, features = ["atom"] }
 secrecy = "=0.10.3"
diff --git a/crates/crates_io_smoke_test/Cargo.toml b/crates/crates_io_smoke_test/Cargo.toml
index 7cb149aaec0..02c91c1e85b 100644
--- a/crates/crates_io_smoke_test/Cargo.toml
+++ b/crates/crates_io_smoke_test/Cargo.toml
@@ -12,7 +12,7 @@ anyhow = "=1.0.95"
 bytes = "=1.10.0"
 clap = { version = "=4.5.28", features = ["derive", "env", "unicode", "wrap_help"] }
 crates_io_index = { path = "../crates_io_index" }
-rand = "=0.8.5"
+rand = "=0.9.0"
 reqwest = { version = "=0.12.12", features = ["gzip", "json"] }
 secrecy = "=0.10.3"
 semver = { version = "=1.0.25", features = ["serde"] }
diff --git a/crates/crates_io_test_db/Cargo.toml b/crates/crates_io_test_db/Cargo.toml
index 5ab03686645..727f937ebf8 100644
--- a/crates/crates_io_test_db/Cargo.toml
+++ b/crates/crates_io_test_db/Cargo.toml
@@ -12,6 +12,6 @@ crates_io_env_vars = { path = "../crates_io_env_vars" }
 diesel = { version = "=2.2.7", features = ["postgres", "r2d2"] }
 diesel-async = { version = "=0.5.2", features = ["postgres"] }
 diesel_migrations = { version = "=2.2.0", features = ["postgres"] }
-rand = "=0.8.5"
+rand = "=0.9.0"
 tracing = "=0.1.41"
 url = "=2.5.4"
diff --git a/crates/crates_io_test_db/src/lib.rs b/crates/crates_io_test_db/src/lib.rs
index 47388409e59..445da5465ef 100644
--- a/crates/crates_io_test_db/src/lib.rs
+++ b/crates/crates_io_test_db/src/lib.rs
@@ -216,9 +216,9 @@ fn run_migrations(conn: &mut PgConnection) -> diesel::migration::Result<()> {
 }
 
 fn generate_name() -> String {
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rng();
     std::iter::repeat(())
-        .map(|_| rng.sample(rand::distributions::Alphanumeric) as char)
+        .map(|_| rng.sample(rand::distr::Alphanumeric) as char)
         .take(16)
         .collect()
 }
diff --git a/src/bin/crates-admin/populate.rs b/src/bin/crates-admin/populate.rs
index 5a3bf2cb9b1..5a8e137c8c2 100644
--- a/src/bin/crates-admin/populate.rs
+++ b/src/bin/crates-admin/populate.rs
@@ -3,8 +3,7 @@ use crates_io::{db, schema::version_downloads};
 use diesel::prelude::*;
 use diesel_async::scoped_futures::ScopedFutureExt;
 use diesel_async::{AsyncConnection, AsyncPgConnection, RunQueryDsl};
-use rand::rngs::StdRng;
-use rand::{Rng, SeedableRng};
+use rand::Rng;
 
 #[derive(clap::Parser, Debug)]
 #[command(
@@ -27,11 +26,10 @@ async fn update(opts: Opts, conn: &mut AsyncPgConnection) -> QueryResult<()> {
     use diesel::dsl::*;
 
     for id in opts.version_ids {
-        let mut rng = StdRng::from_entropy();
-        let mut dls = rng.gen_range(5_000i32..10_000);
+        let mut dls = rand::rng().random_range(5_000i32..10_000);
 
         for day in 0..90 {
-            dls += rng.gen_range(-100..100);
+            dls += rand::rng().random_range(-100..100);
 
             diesel::insert_into(version_downloads::table)
                 .values((
diff --git a/src/email.rs b/src/email.rs
index 09c16e4d95a..830f1ab097e 100644
--- a/src/email.rs
+++ b/src/email.rs
@@ -8,7 +8,7 @@ use lettre::transport::smtp::authentication::{Credentials, Mechanism};
 use lettre::transport::smtp::AsyncSmtpTransport;
 use lettre::transport::stub::AsyncStubTransport;
 use lettre::{Address, AsyncTransport, Message, Tokio1Executor};
-use rand::distributions::{Alphanumeric, DistString};
+use rand::distr::{Alphanumeric, SampleString};
 use std::sync::Arc;
 
 pub trait Email {
@@ -99,7 +99,7 @@ impl Emails {
         // replace it when it relays the message.
         let message_id = format!(
             "<{}@{}>",
-            Alphanumeric.sample_string(&mut rand::thread_rng(), 32),
+            Alphanumeric.sample_string(&mut rand::rng(), 32),
             self.domain,
         );
 
diff --git a/src/util/token.rs b/src/util/token.rs
index c978d33b0fe..c83b1b069c1 100644
--- a/src/util/token.rs
+++ b/src/util/token.rs
@@ -1,5 +1,5 @@
 use diesel::{deserialize::FromSql, pg::Pg, serialize::ToSql, sql_types::Bytea};
-use rand::{distributions::Uniform, rngs::OsRng, Rng};
+use rand::distr::{Alphanumeric, SampleString};
 use secrecy::{ExposeSecret, SecretSlice, SecretString};
 use sha2::{Digest, Sha256};
 
@@ -84,13 +84,7 @@ impl ExposeSecret<str> for PlainToken {
 }
 
 fn generate_secure_alphanumeric_string(len: usize) -> String {
-    const CHARS: &[u8] = b"abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
-
-    OsRng
-        .sample_iter(Uniform::from(0..CHARS.len()))
-        .map(|idx| CHARS[idx] as char)
-        .take(len)
-        .collect()
+    Alphanumeric.sample_string(&mut rand::rng(), len)
 }
 
 #[cfg(test)]