diff --git a/Cargo.lock b/Cargo.lock
index e5e9226..d5513d2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -204,7 +204,7 @@ dependencies = [
  "typed-wasm-verify",
  "wasm-encoder",
  "wasmi",
- "wasmparser 0.253.0",
+ "wasmparser 0.254.0",
  "wasmprinter",
 ]
 
@@ -223,8 +223,8 @@ name = "typed-wasm-verify"
 version = "0.1.0"
 dependencies = [
  "thiserror",
- "wasm-encoder",
- "wasmparser 0.253.0",
+ "wasm-encoder 0.253.0",
+ "wasmparser 0.254.0",
 ]
 
 [[package]]
@@ -307,10 +307,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19db11f87d2486580e1e8b6f494c54df7e0566b87d0b599db843c24019667339"
 dependencies = [
  "bitflags",
- "hashbrown 0.17.1",
  "indexmap",
  "semver",
- "serde",
 ]
 
 [[package]]
@@ -320,8 +318,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5769a29f799fbab136aaf65b4fe5384cd7d93fe6fc9ba0dcb6c8382a1f16e27"
 dependencies = [
  "bitflags",
+ "hashbrown 0.17.1",
  "indexmap",
  "semver",
+ "serde",
 ]
 
 [[package]]
diff --git a/crates/typed-wasm-codegen/Cargo.toml b/crates/typed-wasm-codegen/Cargo.toml
index df8bbbc..d8e1c33 100644
--- a/crates/typed-wasm-codegen/Cargo.toml
+++ b/crates/typed-wasm-codegen/Cargo.toml
@@ -30,7 +30,7 @@ typed-wasm-verify = { path = "../typed-wasm-verify", features = ["unstable-l2",
 [dev-dependencies]
 # Round-trip test validates the emitted module is well-formed wasm before
 # handing it to the verifier.
-wasmparser = "=0.253.0"
+wasmparser = "=0.254.0"
 # In-process wasm engine for the Tier-1 differential execution gate
 # (tests/execute_lowering.rs): proves lowered store/load bodies COMPUTE the
 # right memory semantics at runtime, not just that they validate. Pure-Rust so
diff --git a/crates/typed-wasm-verify/Cargo.toml b/crates/typed-wasm-verify/Cargo.toml
index ff694b2..e56eee8 100644
--- a/crates/typed-wasm-verify/Cargo.toml
+++ b/crates/typed-wasm-verify/Cargo.toml
@@ -46,7 +46,7 @@ unstable-l13-imports = ["unstable-l2"]
 # (0.221 -> 0.250 reshaped the import iterator). Keep these locked so the
 # next dependabot bump shows up as a visible Cargo.toml diff and forces a
 # deliberate port rather than a silent lockfile move.
-wasmparser = "=0.253.0"
+wasmparser = "=0.254.0"
 thiserror = "2"
 
 [dev-dependencies]