diff --git a/Cargo.lock b/Cargo.lock
index bc415b62..74983fe9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -121,15 +121,6 @@ dependencies = [
  "wyz",
 ]
 
-[[package]]
-name = "block-buffer"
-version = "0.10.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
-dependencies = [
- "generic-array",
-]
-
 [[package]]
 name = "block-buffer"
 version = "0.12.1"
@@ -228,7 +219,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d524456ba66e72eb8b115ff89e01e497f8e6d11d78b70b1aa13c0fbd97540a81"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
+ "cpufeatures",
  "rand_core 0.10.1",
 ]
 
@@ -330,15 +321,6 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
-[[package]]
-name = "cpufeatures"
-version = "0.2.17"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -393,16 +375,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
-[[package]]
-name = "crypto-common"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
-dependencies = [
- "generic-array",
- "typenum",
-]
-
 [[package]]
 name = "crypto-common"
 version = "0.2.2"
@@ -516,25 +488,15 @@ dependencies = [
  "unicode-xid",
 ]
 
-[[package]]
-name = "digest"
-version = "0.10.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
-dependencies = [
- "block-buffer 0.10.4",
- "crypto-common 0.1.7",
-]
-
 [[package]]
 name = "digest"
 version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
- "block-buffer 0.12.1",
+ "block-buffer",
  "const-oid",
- "crypto-common 0.2.2",
+ "crypto-common",
  "ctutils",
 ]
 
@@ -747,16 +709,6 @@ dependencies = [
  "slab",
 ]
 
-[[package]]
-name = "generic-array"
-version = "0.14.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
-dependencies = [
- "typenum",
- "version_check",
-]
-
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -913,7 +865,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6303bc9732ae41b04cb554b844a762b4115a61bfaa81e3e83050991eeb56863f"
 dependencies = [
- "digest 0.11.3",
+ "digest",
 ]
 
 [[package]]
@@ -1423,7 +1375,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69b6441f590336821bb897fb28fc622898ccceb1d6cea3fde5ea86b090c4de98"
 dependencies = [
  "cfg-if",
- "digest 0.11.3",
+ "digest",
 ]
 
 [[package]]
@@ -1520,7 +1472,7 @@ dependencies = [
  "serde_bytes",
  "serde_with",
  "sha1",
- "sha2 0.11.0",
+ "sha2",
  "socket2",
  "stringprep",
  "strsim",
@@ -1641,7 +1593,7 @@ version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "112d82ceb8c5bf524d9af484d4e4970c9fd5a0cc15ba14ad93dccd28873b0629"
 dependencies = [
- "digest 0.11.3",
+ "digest",
 ]
 
 [[package]]
@@ -2288,19 +2240,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
-]
-
-[[package]]
-name = "sha2"
-version = "0.10.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
-dependencies = [
- "cfg-if",
- "cpufeatures 0.2.17",
- "digest 0.10.7",
+ "cpufeatures",
+ "digest",
 ]
 
 [[package]]
@@ -2310,8 +2251,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "446ba717509524cb3f22f17ecc096f10f4822d76ab5c0b9822c5f9c284e825f4"
 dependencies = [
  "cfg-if",
- "cpufeatures 0.3.0",
- "digest 0.11.3",
+ "cpufeatures",
+ "digest",
 ]
 
 [[package]]
@@ -2579,6 +2520,7 @@ dependencies = [
  "futures-timer",
  "futures-util",
  "getrandom 0.4.3",
+ "hex",
  "image",
  "jaq-core",
  "jaq-json",
@@ -2587,7 +2529,7 @@ dependencies = [
  "reqwest",
  "serde",
  "serde_json",
- "sha2 0.10.9",
+ "sha2",
  "tempfile",
  "thiserror",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index 87186e91..0b816c5e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -33,6 +33,6 @@ thiserror = "2"
 tracing = { version = "0.1", default-features = false, features = ["std"] }
 tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time"] }
 rusqlite = { version = "0.40", features = ["bundled"] }
-sha2 = "0.10"
+sha2 = "0.11"
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde", "std"] }
 uuid = { version = "1", features = ["v4", "serde"] }
diff --git a/crates/tinyflows/Cargo.toml b/crates/tinyflows/Cargo.toml
index 23e02812..23795e85 100644
--- a/crates/tinyflows/Cargo.toml
+++ b/crates/tinyflows/Cargo.toml
@@ -34,7 +34,8 @@ tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync", "time"
 reqwest = { version = "0.13", default-features = false, features = ["json"], optional = true }
 # `caps::host` only: hashing an author-supplied state key (and namespace) into
 # one safe path component, and staging a script in a temporary directory.
-sha2 = { version = "0.10", optional = true }
+sha2 = { version = "0.11", optional = true }
+hex = "0.4"
 tempfile = { version = "3", optional = true }
 # `store` only: the advisory file lock that keeps two processes from deciding
 # the same proposal at once.
@@ -81,7 +82,7 @@ proptest = "1"
 # `host-caps` feature is on (the same rule `caps::mock` follows), so what that
 # feature would switch on has to be present for a test build too. An optional
 # dependency is not activated by `cfg(test)`, hence these.
-sha2 = "0.10"
+sha2 = "0.11"
 tempfile = "3"
 fs2 = "0.4"
 reqwest = { version = "0.13", default-features = false, features = ["json", "rustls"] }
diff --git a/crates/tinyflows/src/caps/host/state.rs b/crates/tinyflows/src/caps/host/state.rs
index ef343d45..666278b1 100644
--- a/crates/tinyflows/src/caps/host/state.rs
+++ b/crates/tinyflows/src/caps/host/state.rs
@@ -49,7 +49,7 @@ impl FileStateStore {
 fn digest(value: &str) -> String {
     let mut hasher = Sha256::new();
     hasher.update(value.as_bytes());
-    format!("{:x}", hasher.finalize())
+    hex::encode(hasher.finalize())
 }
 
 #[async_trait]
diff --git a/crates/tinyflows/src/store/file/dirs.rs b/crates/tinyflows/src/store/file/dirs.rs
index fe2b614f..2972d4ba 100644
--- a/crates/tinyflows/src/store/file/dirs.rs
+++ b/crates/tinyflows/src/store/file/dirs.rs
@@ -26,10 +26,7 @@ pub fn workflow_dirs(home: &Path, cwd: &Path, project_dir: &str) -> Vec<PathBuf>
 /// State shared by stores writing the same catalog, beneath the caller's root.
 pub(crate) fn definition_state_dir(state_root: &Path, dirs: &[PathBuf]) -> PathBuf {
     let write_dir = catalog_identity(dirs);
-    let scope = format!(
-        "{:x}",
-        Sha256::digest(write_dir.as_os_str().as_encoded_bytes())
-    );
+    let scope = hex::encode(Sha256::digest(write_dir.as_os_str().as_encoded_bytes()));
     state_root.join("definitions").join(scope)
 }
 
diff --git a/crates/tinyflows/src/store/file/mod.rs b/crates/tinyflows/src/store/file/mod.rs
index 780b3a66..ca3a37ae 100644
--- a/crates/tinyflows/src/store/file/mod.rs
+++ b/crates/tinyflows/src/store/file/mod.rs
@@ -90,8 +90,8 @@ fn scoped_state_dir(state_dir: &Path, workspace: &Path) -> PathBuf {
 /// drift.
 pub fn workspace_scope(workspace: &Path) -> String {
     let identity = std::fs::canonicalize(workspace).unwrap_or_else(|_| absolute_path(workspace));
-    let digest = Sha256::digest(identity.to_string_lossy().as_bytes());
-    format!("{digest:x}")[..16].to_string()
+    let digest = hex::encode(Sha256::digest(identity.to_string_lossy().as_bytes()));
+    digest[..16].to_string()
 }
 
 /// A file-backed proposal decision claim released when dropped.
diff --git a/crates/tinyflows/src/store/types/proposal.rs b/crates/tinyflows/src/store/types/proposal.rs
index 32d0e592..5570a396 100644
--- a/crates/tinyflows/src/store/types/proposal.rs
+++ b/crates/tinyflows/src/store/types/proposal.rs
@@ -125,7 +125,7 @@ impl WorkflowProposal {
 pub fn fingerprint(graph: &crate::model::WorkflowGraph) -> String {
     use sha2::{Digest, Sha256};
     match serde_json::to_vec(graph) {
-        Ok(canonical) => format!("{:x}", Sha256::digest(&canonical)),
+        Ok(canonical) => hex::encode(Sha256::digest(&canonical)),
         // A graph that fails to serialize (a non-finite `Position`, for
         // instance) must not fingerprint the same as every other graph that
         // also fails to serialize. Hashing empty bytes would do exactly that,
diff --git a/crates/tinyflows/src/store/types/workflow.rs b/crates/tinyflows/src/store/types/workflow.rs
index 8e67733e..009f2301 100644
--- a/crates/tinyflows/src/store/types/workflow.rs
+++ b/crates/tinyflows/src/store/types/workflow.rs
@@ -128,7 +128,7 @@ pub fn record_fingerprint(record: &WorkflowRecord) -> String {
     let mut persisted = record.clone();
     persisted.source_path = None;
     match serde_json::to_vec(&persisted) {
-        Ok(canonical) => format!("{:x}", Sha256::digest(&canonical)),
+        Ok(canonical) => hex::encode(Sha256::digest(&canonical)),
         // Same reasoning as `proposal::fingerprint`: hashing empty bytes on a
         // serialization failure would let a compare-and-swap write accept a
         // stale record whenever both the expected and current record happen