diff --git a/CHANGELOG.md b/CHANGELOG.md
index 27593ae6..af4a9bfa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -325,6 +325,8 @@ byte for byte.
 
 ### Security
 
+- Updated `rustls` to 0.23.45 so TLS 1.3 handshakes reject messages that
+  cross encryption-level boundaries within the same record.
 - Bumped `h2` from 0.4.15 to 0.4.16 to address RUSTSEC-2026-0258
   (unbounded buffering of empty HTTP/2 DATA frames, which lets a peer
   drive a connection's memory use without bound).
diff --git a/Cargo.lock b/Cargo.lock
index d3db016b..0e524301 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1767,9 +1767,9 @@ dependencies = [
 
 [[package]]
 name = "rustls"
-version = "0.23.44"
+version = "0.23.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6725596c3f2c3a0aef021139e145d4eafe314a6623e4680ca83852b2c67ab2ba"
+checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
 dependencies = [
  "aws-lc-rs",
  "log",