diff --git a/src/go.mod b/src/go.mod
index c04bc9fe0..391bca130 100644
--- a/src/go.mod
+++ b/src/go.mod
@@ -9,7 +9,7 @@ require (
 	code.cloudfoundry.org/go-loggregator/v10 v10.3.1
 	code.cloudfoundry.org/go-metric-registry v0.0.0-20260203145707-c2be33097cc5
 	code.cloudfoundry.org/go-pubsub v0.0.0-20251204080526-f88eccbecd26
-	code.cloudfoundry.org/tlsconfig v0.48.0
+	code.cloudfoundry.org/tlsconfig v0.49.0
 	github.com/cloudfoundry/noaa/v2 v2.6.0
 	github.com/cloudfoundry/sonde-go v0.0.0-20251217143644-d1670a435f2a
 	github.com/gorilla/handlers v1.5.2
@@ -39,7 +39,7 @@ require (
 	github.com/prometheus/common v0.67.5 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
 	github.com/square/certstrap v1.3.0 // indirect
-	go.step.sm/crypto v0.76.2 // indirect
+	go.step.sm/crypto v0.77.1 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/crypto v0.49.0 // indirect
diff --git a/src/go.sum b/src/go.sum
index 9d1d21d34..c2b734d78 100644
--- a/src/go.sum
+++ b/src/go.sum
@@ -10,8 +10,8 @@ code.cloudfoundry.org/go-metric-registry v0.0.0-20260203145707-c2be33097cc5 h1:j
 code.cloudfoundry.org/go-metric-registry v0.0.0-20260203145707-c2be33097cc5/go.mod h1:FB69X7y8uQj4DvQzE1OXlqXFgV6sfvw7Tt9X84zpRqw=
 code.cloudfoundry.org/go-pubsub v0.0.0-20251204080526-f88eccbecd26 h1:fXQbh80O2qLsEM3cegK9hyNiGj448CqqAzdzDSCYiVo=
 code.cloudfoundry.org/go-pubsub v0.0.0-20251204080526-f88eccbecd26/go.mod h1:QxOFtPAFdKuZ2+ZsNW9GcMfxc8wAucVJ7dCuai+H6+s=
-code.cloudfoundry.org/tlsconfig v0.48.0 h1:pXgD+Ctes+K4lLpXmobDzn47OthNSM/T6q6M2x/FImI=
-code.cloudfoundry.org/tlsconfig v0.48.0/go.mod h1:Y6e79JPXDXlky4pwaSTJd4qa84GyCW+U09XxSPQiuj4=
+code.cloudfoundry.org/tlsconfig v0.49.0 h1:ponDsxilO6+N1evL7fyGJFH+PJXIriKAsvNI/5QUAn0=
+code.cloudfoundry.org/tlsconfig v0.49.0/go.mod h1:ghAEm7G6wcxlQ9ZihAqzPYde2VaQ44bP3Ud4ewDwuUE=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
 github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0=
@@ -122,8 +122,8 @@ go.opentelemetry.io/otel/sdk/metric v1.39.0 h1:cXMVVFVgsIf2YL6QkRF4Urbr/aMInf+2W
 go.opentelemetry.io/otel/sdk/metric v1.39.0/go.mod h1:xq9HEVH7qeX69/JnwEfp6fVq5wosJsY1mt4lLfYdVew=
 go.opentelemetry.io/otel/trace v1.39.0 h1:2d2vfpEDmCJ5zVYz7ijaJdOF59xLomrvj7bjt6/qCJI=
 go.opentelemetry.io/otel/trace v1.39.0/go.mod h1:88w4/PnZSazkGzz/w84VHpQafiU4EtqqlVdxWy+rNOA=
-go.step.sm/crypto v0.76.2 h1:JJ/yMcs/rmcCAwlo+afrHjq74XBFRTJw5B2y4Q4Z4c4=
-go.step.sm/crypto v0.76.2/go.mod h1:m6KlB/HzIuGFep0UWI5e0SYi38UxpoKeCg6qUaHV6/Q=
+go.step.sm/crypto v0.77.1 h1:4EEqfKdv0egQ1lqz2RhnU8Jv6QgXZfrgoxWMqJF9aDs=
+go.step.sm/crypto v0.77.1/go.mod h1:U/SsmEm80mNnfD5WIkbhuW/B1eFp3fgFvdXyDLpU1AQ=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
diff --git a/src/vendor/go.step.sm/crypto/keyutil/key.go b/src/vendor/go.step.sm/crypto/keyutil/key.go
index 171cdf3f6..a8ec53d82 100644
--- a/src/vendor/go.step.sm/crypto/keyutil/key.go
+++ b/src/vendor/go.step.sm/crypto/keyutil/key.go
@@ -14,8 +14,9 @@ import (
 	"sync/atomic"
 
 	"github.com/pkg/errors"
-	"go.step.sm/crypto/x25519"
 	"golang.org/x/crypto/ssh"
+
+	"go.step.sm/crypto/x25519"
 )
 
 var (
diff --git a/src/vendor/go.step.sm/crypto/pemutil/pkcs8.go b/src/vendor/go.step.sm/crypto/pemutil/pkcs8.go
index 85bdc1f4f..3460f459c 100644
--- a/src/vendor/go.step.sm/crypto/pemutil/pkcs8.go
+++ b/src/vendor/go.step.sm/crypto/pemutil/pkcs8.go
@@ -35,7 +35,7 @@ const PBKDF2Iterations = 600000
 type pkcs8 struct {
 	Version    int
 	Algo       pkix.AlgorithmIdentifier
-	PrivateKey []byte //nolint:gosec // PrivateKey field for PKCS#8 structure
+	PrivateKey []byte
 	// optional attributes omitted.
 }
 
@@ -81,7 +81,7 @@ type encryptedlAlgorithmIdentifier struct {
 
 type encryptedPrivateKeyInfo struct {
 	Algo       encryptedlAlgorithmIdentifier
-	PrivateKey []byte //nolint:gosec // PrivateKey field for encrypted PKCS#8 structure
+	PrivateKey []byte
 }
 
 var (
diff --git a/src/vendor/go.step.sm/crypto/pemutil/ssh.go b/src/vendor/go.step.sm/crypto/pemutil/ssh.go
index 00698dae1..d8c56be7e 100644
--- a/src/vendor/go.step.sm/crypto/pemutil/ssh.go
+++ b/src/vendor/go.step.sm/crypto/pemutil/ssh.go
@@ -17,9 +17,10 @@ import (
 	"math/big"
 
 	"github.com/pkg/errors"
+	"golang.org/x/crypto/ssh"
+
 	bcryptpbkdf "go.step.sm/crypto/internal/bcrypt_pbkdf"
 	"go.step.sm/crypto/randutil"
-	"golang.org/x/crypto/ssh"
 )
 
 const (
diff --git a/src/vendor/modules.txt b/src/vendor/modules.txt
index d288ed1ac..c3cde6e1e 100644
--- a/src/vendor/modules.txt
+++ b/src/vendor/modules.txt
@@ -19,7 +19,7 @@ code.cloudfoundry.org/go-metric-registry
 code.cloudfoundry.org/go-pubsub
 code.cloudfoundry.org/go-pubsub/internal/node
 code.cloudfoundry.org/go-pubsub/pubsub-gen/setters
-# code.cloudfoundry.org/tlsconfig v0.48.0
+# code.cloudfoundry.org/tlsconfig v0.49.0
 ## explicit; go 1.25.0
 code.cloudfoundry.org/tlsconfig
 code.cloudfoundry.org/tlsconfig/certtest
@@ -143,8 +143,8 @@ github.com/prometheus/procfs/internal/util
 # github.com/square/certstrap v1.3.0
 ## explicit; go 1.18
 github.com/square/certstrap/pkix
-# go.step.sm/crypto v0.76.2
-## explicit; go 1.24.0
+# go.step.sm/crypto v0.77.1
+## explicit; go 1.25.0
 go.step.sm/crypto/fingerprint
 go.step.sm/crypto/internal/bcrypt_pbkdf
 go.step.sm/crypto/internal/emoji