diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c14751e94..10181f09b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -73,6 +73,8 @@ jobs:
           path: target
           key: check-wasm32-target-${{ runner.os }}-${{ steps.rust-version.outputs.version }}-${{ hashFiles('Cargo.lock') }}
       - run: cargo check --target wasm32-unknown-unknown --manifest-path tokio-postgres/Cargo.toml --no-default-features --features js
+        env:
+          RUSTFLAGS: --cfg getrandom_backend="wasm_js"
 
   test:
     name: test
diff --git a/postgres-protocol/Cargo.toml b/postgres-protocol/Cargo.toml
index 49cf2d59c..f7a34b2d8 100644
--- a/postgres-protocol/Cargo.toml
+++ b/postgres-protocol/Cargo.toml
@@ -10,7 +10,7 @@ readme = "../README.md"
 
 [features]
 default = []
-js = ["getrandom/js"]
+js = ["getrandom/wasm_js"]
 
 [dependencies]
 base64 = "0.22"
@@ -20,7 +20,7 @@ fallible-iterator = "0.2"
 hmac = "0.12"
 md-5 = "0.10"
 memchr = "2.0"
-rand = "0.8"
+rand = "0.9"
 sha2 = "0.10"
 stringprep = "0.1"
-getrandom = { version = "0.2", optional = true }
+getrandom = { version = "0.3", optional = true }
diff --git a/postgres-protocol/src/authentication/sasl.rs b/postgres-protocol/src/authentication/sasl.rs
index 4a77507e9..ccd40e8d0 100644
--- a/postgres-protocol/src/authentication/sasl.rs
+++ b/postgres-protocol/src/authentication/sasl.rs
@@ -136,10 +136,10 @@ impl ScramSha256 {
     /// Constructs a new instance which will use the provided password for authentication.
     pub fn new(password: &[u8], channel_binding: ChannelBinding) -> ScramSha256 {
         // rand 0.5's ThreadRng is cryptographically secure
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         let nonce = (0..NONCE_LENGTH)
             .map(|_| {
-                let mut v = rng.gen_range(0x21u8..0x7e);
+                let mut v = rng.random_range(0x21u8..0x7e);
                 if v == 0x2c {
                     v = 0x7e
                 }
diff --git a/postgres-protocol/src/password/mod.rs b/postgres-protocol/src/password/mod.rs
index f03bb811d..445fb0c0e 100644
--- a/postgres-protocol/src/password/mod.rs
+++ b/postgres-protocol/src/password/mod.rs
@@ -28,7 +28,7 @@ const SCRAM_DEFAULT_SALT_LEN: usize = 16;
 /// special characters that would require escaping in an SQL command.
 pub fn scram_sha_256(password: &[u8]) -> String {
     let mut salt: [u8; SCRAM_DEFAULT_SALT_LEN] = [0; SCRAM_DEFAULT_SALT_LEN];
-    let mut rng = rand::thread_rng();
+    let mut rng = rand::rng();
     rng.fill_bytes(&mut salt);
     scram_sha_256_salt(password, salt)
 }
diff --git a/tokio-postgres/Cargo.toml b/tokio-postgres/Cargo.toml
index ee6fefb81..3fea01ff0 100644
--- a/tokio-postgres/Cargo.toml
+++ b/tokio-postgres/Cargo.toml
@@ -59,7 +59,7 @@ postgres-protocol = { version = "0.6.7", path = "../postgres-protocol" }
 postgres-types = { version = "0.2.8", path = "../postgres-types" }
 tokio = { version = "1.27", features = ["io-util"] }
 tokio-util = { version = "0.7", features = ["codec"] }
-rand = "0.8.5"
+rand = "0.9.0"
 whoami = "1.4.1"
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
diff --git a/tokio-postgres/src/connect.rs b/tokio-postgres/src/connect.rs
index 8189cb91c..e97a7a2a3 100644
--- a/tokio-postgres/src/connect.rs
+++ b/tokio-postgres/src/connect.rs
@@ -44,7 +44,7 @@ where
 
     let mut indices = (0..num_hosts).collect::<Vec<_>>();
     if config.load_balance_hosts == LoadBalanceHosts::Random {
-        indices.shuffle(&mut rand::thread_rng());
+        indices.shuffle(&mut rand::rng());
     }
 
     let mut error = None;
@@ -101,7 +101,7 @@ where
                 .collect::<Vec<_>>();
 
             if config.load_balance_hosts == LoadBalanceHosts::Random {
-                addrs.shuffle(&mut rand::thread_rng());
+                addrs.shuffle(&mut rand::rng());
             }
 
             let mut last_err = None;