diff --git a/Cargo.lock b/Cargo.lock
index 7acdaf6..3bcd291 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -550,7 +550,7 @@ dependencies = [
  "libarchive_oxide-fuzz-cases",
  "lz4",
  "lz4_flex",
- "lzma-rust2",
+ "lzma-rust2 0.18.0",
  "miniz_oxide 0.9.1",
  "pbkdf2",
  "rustix",
@@ -590,7 +590,7 @@ dependencies = [
  "arbitrary",
  "libarchive_oxide",
  "libarchive_oxide-core",
- "lzma-rust2",
+ "lzma-rust2 0.16.5",
 ]
 
 [[package]]
@@ -665,6 +665,15 @@ dependencies = [
  "sha2",
 ]
 
+[[package]]
+name = "lzma-rust2"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "12931b17820a3a0c48e46359d2be49ef57b5d50509fd5baba43e6c654977aa66"
+dependencies = [
+ "sha2",
+]
+
 [[package]]
 name = "lzma-sys"
 version = "0.1.20"
@@ -864,7 +873,7 @@ dependencies = [
  "flate2",
  "getrandom",
  "js-sys",
- "lzma-rust2",
+ "lzma-rust2 0.16.5",
  "ppmd-rust",
  "sha2",
  "wasm-bindgen",
@@ -1278,7 +1287,7 @@ dependencies = [
  "getrandom",
  "hmac",
  "indexmap",
- "lzma-rust2",
+ "lzma-rust2 0.16.5",
  "memchr",
  "pbkdf2",
  "sha1",
diff --git a/libarchive_oxide/Cargo.toml b/libarchive_oxide/Cargo.toml
index 849ab73..4146b09 100644
--- a/libarchive_oxide/Cargo.toml
+++ b/libarchive_oxide/Cargo.toml
@@ -83,7 +83,7 @@ bzip2 = { version = "0.6.1", optional = true }
 flate2 = { version = "1.1.9", default-features = false, features = ["zlib"], optional = true }
 xz-codec = { package = "xz2", version = "0.1.7", optional = true }
 # Shared by xz and 7z.
-lzma-rust2 = { version = "0.16.5", default-features = false, features = ["std", "encoder", "xz"], optional = true }
+lzma-rust2 = { version = "0.18.0", default-features = false, features = ["std", "encoder", "xz"], optional = true }
 # WinZip AE-2 requires SHA-1. `zeroize` wipes the expanded AES key schedule on drop,
 # so a folder/member key never lingers in freed memory after the decoder is dropped
 # (defense in depth for both the 7z CBC and the ZIP AE-2 CTR paths).
@@ -118,7 +118,7 @@ flate2 = "1"
 lz4_flex = { version = "0.14.0", default-features = false, features = ["frame"] }
 # Independent liblz4 consumer used only to validate our Pure-Rust writer output.
 lz4-codec = { package = "lz4", version = "1.28.1" }
-lzma-rust2 = "0.16.5"
+lzma-rust2 = "0.18.0"
 # Independent liblzma producer/consumer used only for XZ interoperability tests.
 xz-codec = { package = "xz2", version = "0.1.7" }
 ruzstd = "0.8.2"