diff --git a/Cargo.lock b/Cargo.lock
index 3847c03..754c297 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7383,9 +7383,9 @@ dependencies = [
 
 [[package]]
 name = "tokio-util"
-version = "0.7.17"
+version = "0.7.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2efa149fe76073d6e8fd97ef4f4eca7b67f599660115591483572e406e165594"
+checksum = "9ae9cec805b01e8fc3fd2fe289f89149a9b66dd16786abd8b19cfa7b48cb0098"
 dependencies = [
  "bytes",
  "futures-core",
diff --git a/crates/capsule-registry/Cargo.toml b/crates/capsule-registry/Cargo.toml
index 745752f..d829162 100644
--- a/crates/capsule-registry/Cargo.toml
+++ b/crates/capsule-registry/Cargo.toml
@@ -47,7 +47,7 @@ pipeline = { path = "../pipeline", optional = true }
 scaling = { path = "../scaling", optional = true }
 sim-nvram = { path = "../sim-nvram", version = "0.1.0" }  # For simulation mode support
 async-trait = "0.1"
-tokio-util = { version = "^0.7.11", features = ["io"] }
+tokio-util = { version = "^0.7.18", features = ["io"] }
 async-stream = "0.3"
 
 # Phase 3: distributed consensus (Raft)
diff --git a/crates/pipeline/Cargo.toml b/crates/pipeline/Cargo.toml
index 361fe2c..8bbffc2 100644
--- a/crates/pipeline/Cargo.toml
+++ b/crates/pipeline/Cargo.toml
@@ -24,7 +24,7 @@ tracing = { workspace = true }
 blake3 = { workspace = true }
 hex = { workspace = true }
 tokio = { workspace = true }
-tokio-util = { version = "^0.7.11", features = ["io"] }
+tokio-util = { version = "^0.7.18", features = ["io"] }
 bytes = { workspace = true }
 async-stream = "0.3"
 uuid = { workspace = true }
diff --git a/crates/protocol-s3/Cargo.toml b/crates/protocol-s3/Cargo.toml
index 10226cd..e3fbebb 100644
--- a/crates/protocol-s3/Cargo.toml
+++ b/crates/protocol-s3/Cargo.toml
@@ -25,7 +25,7 @@ axum = { workspace = true, features = ["http2", "multipart"] } # 2025-11-03 sw:
 tokio = { workspace = true }
 tower = { version = "^0.4.13", features = ["util"] } # 2025-11-03 sw: aligns with axum 0.7 require
 tower-http = { workspace = true, features = ["cors", "trace"] } # 2025-11-03 sw: HTTP middleware review logged
-tokio-util = { version = "^0.7.11", features = ["io"] }
+tokio-util = { version = "^0.7.18", features = ["io"] }
 
 # Serialization
 serde = { workspace = true }