diff --git a/Cargo.lock b/Cargo.lock
index e68596c..ab49c88 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1151,7 +1151,7 @@ dependencies = [
  "echidna-core-creusot",
  "serde",
  "serde_json",
- "serde_json_canonicalizer",
+ "serde_json_canonicalizer 0.3.2",
  "strum 0.28.0",
 ]
 
@@ -1192,7 +1192,7 @@ dependencies = [
  "semver",
  "serde",
  "serde_json",
- "serde_json_canonicalizer",
+ "serde_json_canonicalizer 0.4.1",
  "sha2 0.11.0",
  "sqlx",
  "tempfile",
@@ -3710,6 +3710,17 @@ dependencies = [
  "serde_json",
 ]
 
+[[package]]
+name = "serde_json_canonicalizer"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "87f7bb64f8c7e9f783fdfe883b5fe93a90bee1597c63705baa91842c5f698620"
+dependencies = [
+ "ryu-js",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "serde_path_to_error"
 version = "0.1.20"
diff --git a/Cargo.toml b/Cargo.toml
index cf6a860..1f1d6d7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -85,7 +85,7 @@ uuid = { version = "1.10", features = ["v7", "v8", "serde"] }
 # RFC 8785 (JCS) canonical bytes for src/ids.rs content ids. The estate
 # crate hyperpolymath/ijson-jcs is not public, so a public build cannot
 # depend on it; swap once it is (docs/ECHIDNA-INTEGRATION.adoc).
-serde_json_canonicalizer = "0.3"
+serde_json_canonicalizer = "0.4"
 chrono = { version = "0.4", features = ["serde"] }
 thiserror = "2"
 anyhow = "1"