diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3aa72d3..8e234ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed — dependencies
+- Bumped `rand` 0.9 → 0.10.2 and `rand_distr` 0.5 → 0.6.0. `candle-core` still
+  pulls `rand` 0.9 / `rand_distr` 0.5 for itself; the crate now depends on both
+  major lines.
+- Migrated call sites for rand 0.10: `Rng` → `RngExt`, `StdRng::from_os_rng()` →
+  `rand::make_rng::<StdRng>()` (typed), and `&mut impl Rng` bounds on sampling /
+  training helpers to `RngExt`.
+
 ### Fixed — checkpointing
 - **Resume was implicit and could silently do nothing.** `train()` loaded any checkpoint it
   found with no flag and no way to opt out, restoring the step counter with it — so
diff --git a/Cargo.lock b/Cargo.lock
index 81003f7..ddd1a04 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -243,8 +243,8 @@ dependencies = [
  "memmap2",
  "num-traits",
  "num_cpus",
- "rand",
- "rand_distr",
+ "rand 0.9.5",
+ "rand_distr 0.5.1",
  "rayon",
  "safetensors",
  "thiserror 2.0.18",
@@ -301,6 +301,17 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "chacha20"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "65c35e4b699c7e15ccbe7ee35c005e4fc0a278d22238a2857e6ce2dadeda1b06"
+dependencies = [
+ "cfg-if",
+ "cpufeatures",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "ciborium"
 version = "0.2.2"
@@ -418,6 +429,15 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ca28b0ae3115b884660db4118d803791fd6756b6e88f39c0f3f7859060d7566"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc32fast"
 version = "1.5.0"
@@ -647,7 +667,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -686,8 +706,8 @@ checksum = "c2d1f04709a8ac06e8e8042875a3c466cc4832d3c1a18dbcb9dba3c6e83046bc"
 dependencies = [
  "half",
  "num-traits",
- "rand",
- "rand_distr",
+ "rand 0.9.5",
+ "rand_distr 0.5.1",
 ]
 
 [[package]]
@@ -882,10 +902,22 @@ checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "libc",
- "r-efi",
+ "r-efi 5.3.0",
  "wasip2",
 ]
 
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
+]
+
 [[package]]
 name = "half"
 version = "2.7.1"
@@ -896,8 +928,8 @@ dependencies = [
  "cfg-if",
  "crunchy",
  "num-traits",
- "rand",
- "rand_distr",
+ "rand 0.9.5",
+ "rand_distr 0.5.1",
  "zerocopy",
 ]
 
@@ -1520,6 +1552,12 @@ version = "5.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
 
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
 [[package]]
 name = "rand"
 version = "0.9.5"
@@ -1527,7 +1565,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9ef1d0d795eb7d84685bca4f72f3649f064e6641543d3a8c415898726a57b41"
 dependencies = [
  "rand_chacha",
- "rand_core",
+ "rand_core 0.9.5",
+]
+
+[[package]]
+name = "rand"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7f5fa3a058cd35567ef9bfa5e75732bee0f9e4c55fa90477bef2dfcdbc4be80"
+dependencies = [
+ "chacha20",
+ "getrandom 0.4.3",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1537,7 +1586,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3022b5f1df60f26e1ffddd6c66e8aa15de382ae63b3a0c1bfc0e4d3e3f325cb"
 dependencies = [
  "ppv-lite86",
- "rand_core",
+ "rand_core 0.9.5",
 ]
 
 [[package]]
@@ -1549,6 +1598,12 @@ dependencies = [
  "getrandom 0.3.4",
 ]
 
+[[package]]
+name = "rand_core"
+version = "0.10.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
+
 [[package]]
 name = "rand_distr"
 version = "0.5.1"
@@ -1556,7 +1611,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a8615d50dcf34fa31f7ab52692afec947c4dd0ab803cc87cb3b0b4570ff7463"
 dependencies = [
  "num-traits",
- "rand",
+ "rand 0.9.5",
+]
+
+[[package]]
+name = "rand_distr"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4d431c2703ccf129de4d45253c03f49ebb22b97d6ad79ee3ecfc7e3f4862c1d8"
+dependencies = [
+ "num-traits",
+ "rand 0.10.2",
 ]
 
 [[package]]
@@ -1661,8 +1726,8 @@ dependencies = [
  "criterion",
  "gemm",
  "half",
- "rand",
- "rand_distr",
+ "rand 0.10.2",
+ "rand_distr 0.6.0",
  "safetensors",
  "serde",
  "serde_json",
@@ -1683,7 +1748,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -1973,7 +2038,7 @@ dependencies = [
  "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
@@ -2085,7 +2150,7 @@ dependencies = [
  "monostate",
  "onig",
  "paste",
- "rand",
+ "rand 0.9.5",
  "rayon",
  "rayon-cond",
  "regex",
@@ -2118,7 +2183,7 @@ dependencies = [
  "monostate",
  "onig",
  "paste",
- "rand",
+ "rand 0.9.5",
  "rayon",
  "rayon-cond",
  "regex",
@@ -2429,7 +2494,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.61.2",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index b477efb..192a3bf 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,8 +28,8 @@ ureq = { version = "3", features = ["json"] }
 gemm = { version = "0.19", features = ["f16"] }
 serde = { version = "1.0", features = ["derive"] }
 serde_yaml = "0.9"
-rand = "0.9"
-rand_distr = "0.5"
+rand = "0.10"
+rand_distr = "0.6"
 bytemuck = "1.25.2"
 half = "2.7"
 clap = { version = "4.6.4", features = ["derive"] }
diff --git a/src/generation/codegen_generate.rs b/src/generation/codegen_generate.rs
index bc6bffc..963450a 100644
--- a/src/generation/codegen_generate.rs
+++ b/src/generation/codegen_generate.rs
@@ -184,7 +184,7 @@ impl CodeGenGenerator {
         // same value at every step.
         let mut rng = match self.seed {
             Some(seed) => StdRng::seed_from_u64(seed),
-            None => StdRng::from_os_rng(),
+            None => rand::make_rng::<StdRng>(),
         };
 
         let mut cache: Option<Vec<KVCache>> = None;
diff --git a/src/generation/glm_generate.rs b/src/generation/glm_generate.rs
index 08fb184..77715aa 100644
--- a/src/generation/glm_generate.rs
+++ b/src/generation/glm_generate.rs
@@ -4,7 +4,6 @@ use crate::generation::sampling::sample;
 use crate::glm::attention_mask::build_glm_mask;
 use crate::glm::model::GLMModel;
 use rand::rngs::StdRng;
-use rand::SeedableRng;
 
 pub struct GLMGenerator {
     model: GLMModel,
@@ -48,7 +47,7 @@ impl GLMGenerator {
     /// No blanks — generates new tokens after the prompt.
     pub fn generate(&self, prompt_token_ids: &[u32]) -> Result<Vec<u32>> {
         let device = self.model.embedding.weight.device();
-        let mut rng = StdRng::from_os_rng();
+        let mut rng: StdRng = rand::make_rng();
         let mut generated = prompt_token_ids.to_vec();
 
         for _step in 0..self.max_new_tokens {
@@ -89,7 +88,7 @@ impl GLMGenerator {
     /// - earlier positions within the same blank (causal within-span)
     pub fn fill_blanks(&self, context: &[u32], blank_lens: &[usize]) -> Result<Vec<u32>> {
         let device = self.model.embedding.weight.device();
-        let mut rng = StdRng::from_os_rng();
+        let mut rng: StdRng = rand::make_rng();
         let total_blank_tokens: usize = blank_lens.iter().sum();
 
         let mut all_tokens = context.to_vec();
diff --git a/src/generation/sampling.rs b/src/generation/sampling.rs
index 1738360..d6aeb8e 100644
--- a/src/generation/sampling.rs
+++ b/src/generation/sampling.rs
@@ -1,5 +1,5 @@
 use candle_core::{DType, Result, Tensor};
-use rand::Rng;
+use rand::RngExt;
 
 /// Sample one token from `logits`.
 ///
@@ -12,7 +12,7 @@ pub fn sample(
     top_p: f64,
     repetition_penalty: f64,
     seen_tokens: &[u32],
-    rng: &mut impl Rng,
+    rng: &mut impl RngExt,
 ) -> Result<u32> {
     let logits = if logits.dtype() != DType::F32 {
         logits.to_dtype(DType::F32)?
diff --git a/src/training/data.rs b/src/training/data.rs
index 307c002..6b2d449 100644
--- a/src/training/data.rs
+++ b/src/training/data.rs
@@ -2,7 +2,7 @@ use crate::tokenizer::CodeGenTokenizer;
 use candle_core::Result;
 use rand::rngs::StdRng;
 use rand::seq::SliceRandom;
-use rand::Rng;
+use rand::RngExt;
 use rand::SeedableRng;
 use std::io::Read;
 use std::path::Path;
diff --git a/src/training/train.rs b/src/training/train.rs
index 66c4270..410d67f 100644
--- a/src/training/train.rs
+++ b/src/training/train.rs
@@ -7,7 +7,7 @@ use candle_core::{DType, Device, Result, Tensor, Var};
 use candle_nn::{AdamW, Optimizer, ParamsAdamW};
 use half;
 use rand::rngs::StdRng;
-use rand::{Rng, SeedableRng};
+use rand::{RngExt, SeedableRng};
 use safetensors::tensor::TensorView;
 use safetensors::SafeTensors;
 
@@ -40,7 +40,7 @@ pub struct GLMTrainer {
 /// Corrupt a sequence for masked denoising: some positions are replaced by the
 /// mask token or a random token, and their originals become the labels.
 /// Positions left alone get `-1`, which [`cross_entropy_loss`] ignores.
-fn corrupt(config: &GLMConfig, tokens: &[u32], rng: &mut impl Rng) -> (Vec<u32>, Vec<i64>) {
+fn corrupt(config: &GLMConfig, tokens: &[u32], rng: &mut impl RngExt) -> (Vec<u32>, Vec<i64>) {
     let mask_token_id = config.vocab_size as u32 - 1;
     let mut inputs = tokens.to_vec();
     let mut labels = vec![-1i64; tokens.len()];