diff --git a/backend/Cargo.lock b/backend/Cargo.lock
index e6b3332514..4a0f55cc41 100644
--- a/backend/Cargo.lock
+++ b/backend/Cargo.lock
@@ -13733,37 +13733,6 @@ dependencies = [
  "webpki-roots 0.26.11",
 ]
 
-[[package]]
-name = "tonic"
-version = "0.13.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7e581ba15a835f4d9ea06c55ab1bd4dce26fc53752c69a04aac00703bfb49ba9"
-dependencies = [
- "async-trait",
- "axum 0.8.9",
- "base64 0.22.1",
- "bytes",
- "h2 0.4.19",
- "http 1.5.0",
- "http-body 1.1.0",
- "http-body-util",
- "hyper 1.11.1",
- "hyper-timeout",
- "hyper-util",
- "percent-encoding",
- "pin-project",
- "prost 0.13.5",
- "rustls-native-certs 0.8.4",
- "socket2 0.5.10",
- "tokio",
- "tokio-rustls 0.26.5",
- "tokio-stream",
- "tower 0.5.3",
- "tower-layer",
- "tower-service",
- "tracing",
-]
-
 [[package]]
 name = "tonic"
 version = "0.14.6"
@@ -16612,7 +16581,7 @@ dependencies = [
  "thiserror 2.0.20",
  "tokio",
  "tokio-util",
- "tonic 0.13.1",
+ "tonic 0.14.6",
  "tower-http",
  "tracing",
  "windmill-api-auth",
diff --git a/backend/Cargo.toml b/backend/Cargo.toml
index bf3b9c4b8d..87d9293ea4 100644
--- a/backend/Cargo.toml
+++ b/backend/Cargo.toml
@@ -711,7 +711,7 @@ prost = "0.14"
 
 bollard = "0.18.1"
 
-tonic = { version = "^0.13", features = ["tls-native-roots"] }
+tonic = { version = "^0.14", features = ["tls-native-roots"] }
 byteorder = "1.5.0"
 
 tikv-jemallocator = { version = "0.5" }
diff --git a/backend/windmill-common/Cargo.toml b/backend/windmill-common/Cargo.toml
index 7cdc224f60..06de7cc4aa 100644
--- a/backend/windmill-common/Cargo.toml
+++ b/backend/windmill-common/Cargo.toml
@@ -130,9 +130,7 @@ opentelemetry_sdk = { workspace = true, optional = true }
 opentelemetry = { workspace = true, optional = true }
 tracing-opentelemetry = { workspace = true, optional = true }
 opentelemetry-appender-tracing = { workspace = true, optional = true }
-# Must be the tonic opentelemetry-otlp builds on (its TLS config types), which is newer than
-# the workspace tonic that google-cloud-pubsub pins.
-tonic = { version = "0.14", features = ["tls-native-roots"], optional = true }
+tonic = { workspace = true, optional = true }
 equivalent = "1.0.2"
 
 [dev-dependencies]