diff --git a/Cargo.toml b/Cargo.toml
index 151c99ed..3f5213ac 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -96,6 +96,11 @@ tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt", "time"]
 time = { version = "0.3", features = ["formatting", "parsing", "macros"] }
 toml = "0.9"
 tower = { version = "0.5", features = ["util", "limit", "make"] }
+# Two crates parse URLs directly -- `didbot-tls` for the ACME directory and
+# `didbot-verify` for an ownership claim's endpoint -- so the version is
+# pinned here rather than per-crate, the way every other shared dependency
+# is.
+url = "2"
 # PKCE's `S256` challenge is base64url, no padding — RFC 7636 §4.2.
 base64 = "0.22"
 # `default-features = false` plus an explicit `ring` here, not the default
diff --git a/crates/didbot-tls/Cargo.toml b/crates/didbot-tls/Cargo.toml
index 96e7f526..aaa4c7db 100644
--- a/crates/didbot-tls/Cargo.toml
+++ b/crates/didbot-tls/Cargo.toml
@@ -25,7 +25,7 @@ thiserror.workspace = true
 time.workspace = true
 tokio.workspace = true
 tracing.workspace = true
-url = "2"
+url.workspace = true
 x509-parser.workspace = true
 
 [dev-dependencies]
diff --git a/crates/didbot-verify/Cargo.toml b/crates/didbot-verify/Cargo.toml
index 53838e65..deb0a7d3 100644
--- a/crates/didbot-verify/Cargo.toml
+++ b/crates/didbot-verify/Cargo.toml
@@ -29,7 +29,7 @@ tokio.workspace = true
 # trailing dot and a trailing slash are spellings, and a byte compare over
 # them let a server escape the shared-host refusal. Already in the graph via
 # reqwest and `didbot-tls`.
-url = "2"
+url.workspace = true
 
 [lints]
 workspace = true