diff --git a/Cargo.lock b/Cargo.lock
index e83da904c92..eb5febc68ba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2960,7 +2960,7 @@ dependencies = [
  "dropshot 0.17.0",
  "git-stub-vcs",
  "hickory-client",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "hickory-resolver 0.25.2",
  "hickory-server",
  "internal-dns-types",
@@ -4721,6 +4721,25 @@ dependencies = [
  "url",
 ]
 
+[[package]]
+name = "hickory-proto"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bab31817bfb44672a252e97fe81cd0c18d1b2cf892108922f6818820df8c643"
+dependencies = [
+ "data-encoding",
+ "idna",
+ "ipnet",
+ "jni 0.22.4",
+ "once_cell",
+ "rand 0.10.0",
+ "ring",
+ "thiserror 2.0.18",
+ "tinyvec",
+ "tracing",
+ "url",
+]
+
 [[package]]
 name = "hickory-resolver"
 version = "0.24.4"
@@ -5672,7 +5691,7 @@ dependencies = [
  "dropshot 0.17.0",
  "expectorate",
  "futures",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "hickory-resolver 0.25.2",
  "internal-dns-types",
  "omicron-common",
@@ -5908,19 +5927,68 @@ dependencies = [
  "cesu8",
  "cfg-if",
  "combine",
- "jni-sys",
+ "jni-sys 0.3.0",
  "log",
  "thiserror 1.0.69",
  "walkdir",
  "windows-sys 0.45.0",
 ]
 
+[[package]]
+name = "jni"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5efd9a482cf3a427f00d6b35f14332adc7902ce91efb778580e180ff90fa3498"
+dependencies = [
+ "cfg-if",
+ "combine",
+ "jni-macros",
+ "jni-sys 0.4.1",
+ "log",
+ "simd_cesu8",
+ "thiserror 2.0.18",
+ "walkdir",
+ "windows-link",
+]
+
+[[package]]
+name = "jni-macros"
+version = "0.22.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a00109accc170f0bdb141fed3e393c565b6f5e072365c3bd58f5b062591560a3"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version 0.4.1",
+ "simd_cesu8",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jni-sys"
 version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8eaf4bc02d17cbdd7ff4c7438cafcdf7fb9a4613313ad11b4f8fefe7d3fa0130"
 
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.34"
@@ -9457,6 +9525,7 @@ dependencies = [
  "proc-macro2",
  "proptest",
  "quote",
+ "rand 0.10.0",
  "rand 0.8.6",
  "rand 0.9.2",
  "rand_chacha 0.3.1",
@@ -12649,7 +12718,7 @@ checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
- "jni",
+ "jni 0.21.1",
  "log",
  "once_cell",
  "rustls 0.23.37",
@@ -13459,6 +13528,22 @@ version = "0.3.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e320a6c5ad31d271ad523dcf3ad13e2767ad8b1cb8f047f75a8aeaf8da139da2"
 
+[[package]]
+name = "simd_cesu8"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "94f90157bb87cddf702797c5dadfa0be7d266cdf49e22da2fcaa32eff75b2c33"
+dependencies = [
+ "rustc_version 0.4.1",
+ "simdutf8",
+]
+
+[[package]]
+name = "simdutf8"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3a9fe34e3e7a50316060351f37187a3f546bce95496156754b601a5fa71b76e"
+
 [[package]]
 name = "similar"
 version = "2.7.0"
@@ -15731,7 +15816,7 @@ dependencies = [
  "dns-server",
  "dns-service-client",
  "dropshot 0.17.0",
- "hickory-proto 0.25.2",
+ "hickory-proto 0.26.1",
  "hickory-resolver 0.25.2",
  "internal-dns-types",
  "omicron-workspace-hack",
diff --git a/Cargo.toml b/Cargo.toml
index 0a9cc97e5c7..1d9b4deb187 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -551,7 +551,7 @@ heck = "0.5"
 hex = "0.4.3"
 hex-literal = "0.4.1"
 hickory-client = "0.25.2"
-hickory-proto = "0.25.2"
+hickory-proto = "0.26.0"
 hickory-resolver = "0.25.2"
 hickory-server = "0.25.2"
 highway = "1.3.0"
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index e04f06954c6..1bf574e0160 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -67,7 +67,7 @@ group = { version = "0.13.0", default-features = false, features = ["alloc"] }
 hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.5" }
 hashbrown-986da7b5efc2b80e = { package = "hashbrown", version = "0.16.1" }
 hex = { version = "0.4.3", features = ["serde"] }
-hickory-proto = { version = "0.25.2", features = ["serde", "text-parsing"] }
+hickory-proto = { version = "0.25.2", default-features = false, features = ["serde", "text-parsing", "tokio"] }
 hmac = { version = "0.12.1", default-features = false, features = ["reset"] }
 hyper = { version = "1.8.1", features = ["full"] }
 iddqd = { version = "0.4.1", features = ["daft", "proptest", "schemars08"] }
@@ -214,7 +214,7 @@ hashbrown-3575ec1268b04181 = { package = "hashbrown", version = "0.15.5" }
 hashbrown-986da7b5efc2b80e = { package = "hashbrown", version = "0.16.1" }
 heck = { version = "0.4.1", features = ["unicode"] }
 hex = { version = "0.4.3", features = ["serde"] }
-hickory-proto = { version = "0.25.2", features = ["serde", "text-parsing"] }
+hickory-proto = { version = "0.25.2", default-features = false, features = ["serde", "text-parsing", "tokio"] }
 hmac = { version = "0.12.1", default-features = false, features = ["reset"] }
 hyper = { version = "1.8.1", features = ["full"] }
 iddqd = { version = "0.4.1", features = ["daft", "proptest", "schemars08"] }
@@ -319,6 +319,7 @@ aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 dof-468e82937335b1c9 = { package = "dof", version = "0.3.0", default-features = false, features = ["des"] }
 dof-9fbad63c4bcf4a8f = { package = "dof", version = "0.4.0", default-features = false, features = ["des"] }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 linux-raw-sys = { version = "0.4.15", default-features = false, features = ["elf", "errno", "general", "ioctl", "no_std", "system"] }
@@ -333,6 +334,7 @@ aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 dof-468e82937335b1c9 = { package = "dof", version = "0.3.0", default-features = false, features = ["des"] }
 dof-9fbad63c4bcf4a8f = { package = "dof", version = "0.4.0", default-features = false, features = ["des"] }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 linux-raw-sys = { version = "0.4.15", default-features = false, features = ["elf", "errno", "general", "ioctl", "no_std", "system"] }
@@ -346,6 +348,7 @@ tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-
 aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 errno = { version = "0.3.14" }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
@@ -358,6 +361,7 @@ tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-
 aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 errno = { version = "0.3.14" }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
@@ -370,6 +374,7 @@ tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-
 aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 errno = { version = "0.3.14" }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
@@ -382,6 +387,7 @@ tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-
 aws-lc-rs = { version = "1.16.3", features = ["prebuilt-nasm"] }
 cookie = { version = "0.18.1", default-features = false, features = ["percent-encode"] }
 errno = { version = "0.3.14" }
+getrandom-9fbad63c4bcf4a8f = { package = "getrandom", version = "0.4.1", default-features = false, features = ["std", "sys_rng"] }
 hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"] }
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
@@ -401,6 +407,7 @@ hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
 object = { version = "0.37.3", default-features = false, features = ["read", "std"] }
+rand-93f6ce9d446188ac = { package = "rand", version = "0.10.0" }
 rustix-d585fab2519d2d1 = { package = "rustix", version = "0.38.44", features = ["fs", "stdio", "system", "termios"] }
 rustix-dff4ba8e3ae991db = { package = "rustix", version = "1.1.3", features = ["fs", "stdio", "termios"] }
 tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-lc-rs"] }
@@ -418,6 +425,7 @@ hyper-rustls = { version = "0.27.7", features = ["http2", "ring", "webpki-tokio"
 hyper-util = { version = "0.1.20", features = ["full"] }
 mio = { version = "1.2.0", features = ["net", "os-ext"] }
 object = { version = "0.37.3", default-features = false, features = ["read", "std"] }
+rand-93f6ce9d446188ac = { package = "rand", version = "0.10.0" }
 rustix-d585fab2519d2d1 = { package = "rustix", version = "0.38.44", features = ["fs", "stdio", "system", "termios"] }
 rustix-dff4ba8e3ae991db = { package = "rustix", version = "1.1.3", features = ["fs", "stdio", "termios"] }
 tokio-rustls = { version = "0.26.4", default-features = false, features = ["aws-lc-rs"] }