diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0765597..bb78f46 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,17 @@ not always match the Git tags; section versions follow the tags.
 
 ## [Unreleased]
 
+### Changed
+
+- `integrity-lineage-models`: `utoipa` from 3.5.0 to 6.0.0. **Breaking:** the models'
+  `ToSchema` implementations are now utoipa 6's, so an OpenAPI document that embeds
+  them has to be built with utoipa 6. Serialization and the Rust API are unchanged.
+  The schemas describe the same JSON, now in OpenAPI 3.1 form: a nullable field's
+  `type` includes `"null"`, references carry their doc comments, and maps declare
+  string keys. The internally tagged `anchor::Location` enum no longer has a
+  `discriminator`; each variant still requires its `type` value.
+  ([#57](https://github.com/eqtylab/integrity/pull/57))
+
 ## [0.0.20] - 2026-10-28
 
 ### Changed
diff --git a/Cargo.lock b/Cargo.lock
index e9f9812..94dac5c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8253,6 +8253,17 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "syn"
+version = "3.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d78c8dee4c7bf0e14673097256fed6142ce9d3b85a408189d07482442145823b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
 [[package]]
 name = "sync_wrapper"
 version = "1.0.2"
@@ -8777,9 +8788,9 @@ checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "utoipa"
-version = "3.5.0"
+version = "6.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d82b1bc5417102a73e8464c686eef947bdfb99fcdfc0a4f228e81afa9526470a"
+checksum = "8765fe27aeff71012a3f90fa474cf1df863a7d0dd81ed25de4e63fff2544994f"
 dependencies = [
  "indexmap 2.14.2",
  "serde",
@@ -8789,15 +8800,14 @@ dependencies = [
 
 [[package]]
 name = "utoipa-gen"
-version = "3.5.0"
+version = "6.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "05d96dcd6fc96f3df9b3280ef480770af1b7c5d14bc55192baa9b067976d920c"
+checksum = "d935f1c83fdf8b88f09bbe050d0cea78ea4afee6d7b0317403228c1200b2c8ab"
 dependencies = [
- "proc-macro-error",
  "proc-macro2",
  "quote",
  "regex",
- "syn 2.0.114",
+ "syn 3.0.9",
 ]
 
 [[package]]
diff --git a/integrity-lineage-models/Cargo.toml b/integrity-lineage-models/Cargo.toml
index d3a422d..28ed043 100644
--- a/integrity-lineage-models/Cargo.toml
+++ b/integrity-lineage-models/Cargo.toml
@@ -22,7 +22,7 @@ serde = { version = "1.0", features = ["derive"] }
 serde_jcs = "0.2.0"
 serde_json = "1.0"
 ssi = { version = "0.16", default-features = false, features = ["w3c", "ed25519", "secp256k1", "secp256r1"] }
-utoipa = { version = "3", features = ["axum_extras", "openapi_extensions"] }
+utoipa = { version = "6", features = ["axum_extras", "openapi_extensions"] }
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 blake3 = "1.5"
diff --git a/integrity-lineage-models/src/models/statements/common.rs b/integrity-lineage-models/src/models/statements/common.rs
index d161f0c..4bbf1f4 100644
--- a/integrity-lineage-models/src/models/statements/common.rs
+++ b/integrity-lineage-models/src/models/statements/common.rs
@@ -15,6 +15,7 @@ pub struct UrnCidWithSha256 {
     #[serde(rename = "@id")]
     pub cid: String,
     /// SHA-256 hash of the content
+    #[schema(value_type = String, format = Binary)]
     #[serde(
         serialize_with = "serialize_u8_arr_as_hex",
         deserialize_with = "deserialize_u8_arr_32_from_hex"
@@ -30,6 +31,7 @@ pub struct UrnCidWithSha384 {
     #[serde(rename = "@id")]
     pub cid: String,
     /// SHA-384 hash of the content
+    #[schema(value_type = String, format = Binary)]
     #[serde(
         serialize_with = "serialize_u8_arr_as_hex",
         deserialize_with = "deserialize_u8_arr_48_from_hex"