diff --git a/Cargo.lock b/Cargo.lock
index 8548b98f..8b83b19c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2485,7 +2485,7 @@ dependencies = [
  "tracing",
  "uuid",
  "version-info",
- "webpki-roots 0.22.6",
+ "webpki-roots",
  "zstd",
 ]
 
@@ -4195,7 +4195,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots 0.25.2",
+ "webpki-roots",
  "winreg",
 ]
 
@@ -4222,7 +4222,7 @@ dependencies = [
  "tokio",
  "tokio-rustls",
  "tracing",
- "webpki-roots 0.22.6",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -5884,25 +5884,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki"
-version = "0.22.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f095d78192e208183081cc07bc5515ef55216397af48b873e5edcd72637fa1bd"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
-name = "webpki-roots"
-version = "0.22.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6c71e40d7d2c34a5106301fb632274ca37242cd0c9d3e64dbece371a40a2d87"
-dependencies = [
- "webpki",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "0.25.2"
diff --git a/Cargo.toml b/Cargo.toml
index e8445fff..812c9463 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -37,3 +37,4 @@ tokio-rustls = "0.24"
 # to match the version that we are using when you update this dep
 trust-dns-resolver = "0.23"
 uuid = "1.4"
+webpki-roots = "0.25"
diff --git a/crates/kumod/Cargo.toml b/crates/kumod/Cargo.toml
index 4acc62c9..76b9f74c 100644
--- a/crates/kumod/Cargo.toml
+++ b/crates/kumod/Cargo.toml
@@ -63,7 +63,7 @@ tokio-rustls = {workspace=true}
 tracing = "0.1"
 uuid = {workspace=true, features=["v4", "fast-rng"]}
 version-info = {path="../version-info"}
-webpki-roots = "0.22"
+webpki-roots = {workspace=true}
 zstd = "0.12"
 
 [dev-dependencies]
diff --git a/crates/rfc5321/Cargo.toml b/crates/rfc5321/Cargo.toml
index fadeadda..32c5fdb7 100644
--- a/crates/rfc5321/Cargo.toml
+++ b/crates/rfc5321/Cargo.toml
@@ -15,4 +15,4 @@ thiserror = "1.0"
 tokio = {workspace=true, features=["full"]}
 tokio-rustls = {workspace=true, features=["dangerous_configuration"]}
 tracing = "0.1"
-webpki-roots = "0.22"
+webpki-roots = {workspace=true}
diff --git a/crates/rfc5321/src/client.rs b/crates/rfc5321/src/client.rs
index 0c254dc3..f4ca9a35 100644
--- a/crates/rfc5321/src/client.rs
+++ b/crates/rfc5321/src/client.rs
@@ -782,7 +782,7 @@ pub fn build_tls_connector(insecure: bool) -> TlsConnector {
     } else {
         let mut root_cert_store = RootCertStore::empty();
 
-        root_cert_store.add_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.0.iter().map(|ta| {
+        root_cert_store.add_trust_anchors(webpki_roots::TLS_SERVER_ROOTS.iter().map(|ta| {
             OwnedTrustAnchor::from_subject_spki_name_constraints(
                 ta.subject,
                 ta.spki,