diff --git a/Cargo.lock b/Cargo.lock
index e90acb0..24ac4f2 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1488,6 +1488,7 @@ dependencies = [
  "chacha20poly1305",
  "chrono",
  "hkdf",
+ "rand 0.8.5",
  "rand_core 0.6.4",
  "reqwest",
  "serde",
@@ -1834,7 +1835,7 @@ dependencies = [
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
- "rand",
+ "rand 0.9.4",
  "ring",
  "rustc-hash",
  "rustls",
@@ -1881,16 +1882,37 @@ version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
+[[package]]
+name = "rand"
+version = "0.8.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "34af8d1a0e25924bc5b7c43c079c942339d8f0a8b57c39049bef581b46327404"
+dependencies = [
+ "libc",
+ "rand_chacha 0.3.1",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "rand"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "44c5af06bb1b7d3216d91932aed5265164bf384dc89cd6ba05cf59a35f5f76ea"
 dependencies = [
- "rand_chacha",
+ "rand_chacha 0.9.0",
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rand_chacha"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e6c10a63a0fa32252be49d21e7709d4d4baf8d231c2dbce1eaa8141b9b127d88"
+dependencies = [
+ "ppv-lite86",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "rand_chacha"
 version = "0.9.0"
diff --git a/Cargo.toml b/Cargo.toml
index 1220e0e..5826569 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -11,7 +11,7 @@ repository = "https://github.com/monkeytroop/monkey-troop"
 
 [workspace.dependencies]
 # Async runtime
-tokio = { version = "1.52", features = ["full"] }
+tokio = { version = "1.52", features = ["full", "test-util"] }
 async-trait = "0.1"
 
 # Web framework
@@ -52,8 +52,8 @@ uuid = { version = "1", features = ["v4"] }
 # Crypto (E2E encryption)
 x25519-dalek = { version = "2.0", features = ["static_secrets"] }
 chacha20poly1305 = "0.10"
-hkdf = "0.12"
+hkdf = "0.12.4"
 sha2 = "0.10"
 base64 = "0.22"
 rand = "0.8"
-rand_core = { version = "0.6", features = ["getrandom"] }
+rand_core = "0.6"
diff --git a/coordinator/tests/unit/application/test_inference_services.py b/coordinator/tests/unit/application/test_inference_services.py
index ff929cf..a9714a7 100644
--- a/coordinator/tests/unit/application/test_inference_services.py
+++ b/coordinator/tests/unit/application/test_inference_services.py
@@ -1,3 +1,4 @@
+from unittest.mock import patch
 from datetime import datetime, timezone
 from unittest.mock import MagicMock
 
@@ -169,9 +170,6 @@ def test_select_node_all_suspended_returns_none(
     assert selected is None
 
 
-from unittest.mock import patch
-
-
 def test__weighted_select_empty_candidates(discovery_service, mock_reputation_repo):
     """If candidates list is empty, return None immediately."""
     selected = discovery_service._weighted_select([])
diff --git a/shared/Cargo.toml b/shared/Cargo.toml
index 6b67434..7c45286 100644
--- a/shared/Cargo.toml
+++ b/shared/Cargo.toml
@@ -18,6 +18,7 @@ chacha20poly1305 = { workspace = true }
 hkdf = { workspace = true }
 sha2 = { workspace = true }
 base64 = { workspace = true }
+rand = { workspace = true }
 rand_core = { workspace = true }
 
 [dev-dependencies]
diff --git a/shared/src/crypto.rs b/shared/src/crypto.rs
index 8855385..7a72423 100644
--- a/shared/src/crypto.rs
+++ b/shared/src/crypto.rs
@@ -4,7 +4,7 @@ use base64::Engine;
 use chacha20poly1305::aead::Aead;
 use chacha20poly1305::{ChaCha20Poly1305, KeyInit, Nonce};
 use hkdf::Hkdf;
-use rand_core::{OsRng, RngCore};
+use rand_core::RngCore;
 use serde::{Deserialize, Serialize};
 use sha2::Sha256;
 use x25519_dalek::{PublicKey, StaticSecret};
@@ -41,7 +41,7 @@ pub struct E2EChunkEnvelope {
 
 /// Generate a new X25519 keypair, returning (secret, base64-encoded public key)
 pub fn generate_keypair() -> (StaticSecret, String) {
-    let secret = StaticSecret::random_from_rng(OsRng);
+    let secret = StaticSecret::random_from_rng(rand::thread_rng());
     let public = PublicKey::from(&secret);
     let public_b64 = BASE64.encode(public.as_bytes());
     (secret, public_b64)
@@ -70,7 +70,7 @@ pub fn derive_session_key(shared_secret: &[u8; 32]) -> Result<[u8; 32]> {
 /// Generate a random 12-byte nonce
 pub fn generate_base_nonce() -> [u8; 12] {
     let mut nonce = [0u8; 12];
-    OsRng.fill_bytes(&mut nonce);
+    rand::thread_rng().fill_bytes(&mut nonce);
     nonce
 }