diff --git a/native/Cargo.lock b/native/Cargo.lock
index bd1424b9..515659d2 100644
--- a/native/Cargo.lock
+++ b/native/Cargo.lock
@@ -985,15 +985,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "keccak"
-version = "0.1.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cb26cec98cce3a3d96cbb7bced3c4b16e3d13f27ec56dbd62cbc8f39cfb9d653"
-dependencies = [
- "cpufeatures 0.2.17",
-]
-
 [[package]]
 name = "keccak"
 version = "0.2.0"
@@ -1006,12 +997,12 @@ dependencies = [
 
 [[package]]
 name = "kem"
-version = "0.3.0-pre.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b8645470337db67b01a7f966decf7d0bafedbae74147d33e641c67a91df239f"
+checksum = "01737161ba802849cfd486b5bd209d38ba4943494c249a8126005170c7621edd"
 dependencies = [
- "rand_core 0.6.4",
- "zeroize",
+ "crypto-common 0.2.2",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1100,13 +1091,15 @@ dependencies = [
 
 [[package]]
 name = "ml-kem"
-version = "0.2.3"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8de49b3df74c35498c0232031bb7e85f9389f913e2796169c8ab47a53993a18f"
+checksum = "5e15f3e5b957493873e396a66914e83e616b6afe335cdef7efe5c6e1216aba66"
 dependencies = [
- "hybrid-array 0.2.3",
+ "hybrid-array 0.4.13",
  "kem",
- "rand_core 0.6.4",
+ "module-lattice",
+ "pkcs8 0.11.0",
+ "rand_core 0.10.1",
  "sha3",
 ]
 
@@ -2540,12 +2533,12 @@ dependencies = [
 
 [[package]]
 name = "sha3"
-version = "0.10.9"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77fd7028345d415a4034cf8777cd4f8ab1851274233b45f84e3d955502d93874"
+checksum = "be176f1a57ce4e3d31c1a166222d9768de5954f811601fb7ca06fc8203905ce1"
 dependencies = [
- "digest 0.10.7",
- "keccak 0.1.6",
+ "digest 0.11.3",
+ "keccak",
 ]
 
 [[package]]
@@ -2555,7 +2548,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09057cb2149ad4cbd2da1e26b351f9a4c354219421229c69c3063e6f61947c4a"
 dependencies = [
  "digest 0.11.3",
- "keccak 0.2.0",
+ "keccak",
  "sponge-cursor",
 ]
 
diff --git a/native/ol_onion/Cargo.toml b/native/ol_onion/Cargo.toml
index f2cc2d51..0a1fd501 100644
--- a/native/ol_onion/Cargo.toml
+++ b/native/ol_onion/Cargo.toml
@@ -21,7 +21,7 @@ curve25519-dalek = { version = "4", default-features = false, features = ["alloc
 # T1.2 PQ-hybrid blinding: ML-KEM-768 mixed into the first hop's
 # shared secret so a quantum-equipped passive recorder can't decrypt
 # historical traffic.
-ml-kem           = "0.2"
+ml-kem           = "0.3"
 hybrid-array     = "0.2"
 aead             = { workspace = true }
 rand_core        = { workspace = true }
diff --git a/native/ol_pqkem/Cargo.toml b/native/ol_pqkem/Cargo.toml
index 9c23d154..849158a1 100644
--- a/native/ol_pqkem/Cargo.toml
+++ b/native/ol_pqkem/Cargo.toml
@@ -12,7 +12,7 @@ crate-type = ["lib"]
 
 [dependencies]
 blake3        = { workspace = true }
-ml-kem        = "0.2"
+ml-kem        = "0.3"
 # Match the hybrid-array version ml-kem 0.2 uses. Required because we
 # need to construct `Array<u8, N>` instances directly to call ml-kem's
 # `KeyEncode::from_bytes` (which takes a typed Array, not a slice).
diff --git a/native/one_link_native/Cargo.toml b/native/one_link_native/Cargo.toml
index ce276865..bfa56d4f 100644
--- a/native/one_link_native/Cargo.toml
+++ b/native/one_link_native/Cargo.toml
@@ -48,7 +48,7 @@ ol_radio_batcher  = { path = "../ol_radio_batcher" }
 ol_compress       = { path = "../ol_compress" }
 ol_fuse           = { path = "../ol_fuse" }
 curve25519-dalek  = { version = "4", default-features = false, features = ["alloc", "precomputed-tables", "zeroize"] }
-ml-kem            = "0.2"
+ml-kem            = "0.3"
 hybrid-array      = "0.2"
 ed25519-dalek   = { workspace = true }
 x25519-dalek    = { version = "2.0", features = ["static_secrets"] }