diff --git a/Cargo.toml b/Cargo.toml
index c1519145ae..7ac6863ca9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -135,3 +135,8 @@ features = ["tokio", "tracing"]
 
 [workspace.dependencies.linkerd2-proxy-api]
 version = "0.18.0"
+
+[workspace.dependencies.rand]
+version = "0.9"
+default-features = false
+features = ["std", "std_rng", "os_rng"]
diff --git a/linkerd/distribute/Cargo.toml b/linkerd/distribute/Cargo.toml
index bce256f44c..b3e35b290a 100644
--- a/linkerd/distribute/Cargo.toml
+++ b/linkerd/distribute/Cargo.toml
@@ -10,7 +10,7 @@ publish = { workspace = true }
 ahash = "0.8"
 linkerd-stack = { path = "../stack" }
 parking_lot = "0.12"
-rand = { version = "0.9", features = ["small_rng"] }
+rand = { workspace = true, features = ["small_rng", "thread_rng"] }
 tracing = { workspace = true }
 
 [dev-dependencies]
diff --git a/linkerd/exp-backoff/Cargo.toml b/linkerd/exp-backoff/Cargo.toml
index e2de5ec105..57a48dc6a2 100644
--- a/linkerd/exp-backoff/Cargo.toml
+++ b/linkerd/exp-backoff/Cargo.toml
@@ -8,7 +8,7 @@ publish = { workspace = true }
 
 [dependencies]
 futures = { version = "0.3", default-features = false }
-rand = { version = "0.9", features = ["small_rng"] }
+rand = { workspace = true, features = ["small_rng", "thread_rng"] }
 thiserror = "2"
 tokio = { version = "1", features = ["time"] }
 pin-project = "1"
diff --git a/linkerd/http/route/Cargo.toml b/linkerd/http/route/Cargo.toml
index b64e436bde..1e059d6b13 100644
--- a/linkerd/http/route/Cargo.toml
+++ b/linkerd/http/route/Cargo.toml
@@ -12,7 +12,7 @@ proto = ["linkerd2-proxy-api"]
 [dependencies]
 http = { workspace = true }
 regex = "1"
-rand = "0.9"
+rand = { workspace = true, features = ["thread_rng"] }
 thiserror = "2"
 tracing = { workspace = true }
 url = "2"
diff --git a/linkerd/pool/p2c/Cargo.toml b/linkerd/pool/p2c/Cargo.toml
index f9fafea01e..8c7ed64d35 100644
--- a/linkerd/pool/p2c/Cargo.toml
+++ b/linkerd/pool/p2c/Cargo.toml
@@ -10,7 +10,7 @@ publish = { workspace = true }
 ahash = "0.8"
 futures = { version = "0.3", default-features = false }
 prometheus-client = { workspace = true }
-rand = { version = "0.9", features = ["small_rng"] }
+rand = { workspace = true, features = ["small_rng", "thread_rng"] }
 tracing = { workspace = true }
 
 linkerd-error = { path = "../../error" }
diff --git a/linkerd/trace-context/Cargo.toml b/linkerd/trace-context/Cargo.toml
index 0b28e15b9c..1f37dd481d 100644
--- a/linkerd/trace-context/Cargo.toml
+++ b/linkerd/trace-context/Cargo.toml
@@ -16,7 +16,7 @@ http = { workspace = true }
 linkerd-error = { path = "../error" }
 linkerd-stack = { path = "../stack" }
 opentelemetry-semantic-conventions = { version = "0.31", default-features = false, features = ["semconv_experimental"] }
-rand = "0.9"
+rand = { workspace = true, features = ["thread_rng"] }
 thiserror = "2"
 tower = { workspace = true, default-features = false, features = ["util"] }
 tracing = { workspace = true }