diff --git a/Cargo.lock b/Cargo.lock
index 4a19608843..5d7b3d4259 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2525,13 +2525,13 @@ dependencies = [
 
 [[package]]
 name = "merlin"
-version = "2.0.1"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e261cf0f8b3c42ded9f7d2bb59dea03aa52bc8a1cbc7482f9fc3fd1229d3b42"
+checksum = "58c38e2799fc0978b65dfff8023ec7843e2330bb462f19198840b34b6582397d"
 dependencies = [
  "byteorder",
  "keccak",
- "rand_core 0.5.1",
+ "rand_core 0.6.3",
  "zeroize",
 ]
 
diff --git a/programs/bpf/Cargo.lock b/programs/bpf/Cargo.lock
index e177f8901c..a1e64a761b 100644
--- a/programs/bpf/Cargo.lock
+++ b/programs/bpf/Cargo.lock
@@ -1623,13 +1623,13 @@ dependencies = [
 
 [[package]]
 name = "merlin"
-version = "2.0.1"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e261cf0f8b3c42ded9f7d2bb59dea03aa52bc8a1cbc7482f9fc3fd1229d3b42"
+checksum = "58c38e2799fc0978b65dfff8023ec7843e2330bb462f19198840b34b6582397d"
 dependencies = [
  "byteorder 1.4.3",
  "keccak",
- "rand_core 0.5.1",
+ "rand_core 0.6.3",
  "zeroize",
 ]
 
diff --git a/zk-token-sdk/Cargo.toml b/zk-token-sdk/Cargo.toml
index c8c9553533..eac149b617 100644
--- a/zk-token-sdk/Cargo.toml
+++ b/zk-token-sdk/Cargo.toml
@@ -23,7 +23,7 @@ cipher = "0.3"
 curve25519-dalek = { version = "3.2.0", features = ["serde"]}
 getrandom = { version = "0.1", features = ["dummy"] }
 lazy_static = "1.4.0"
-merlin = "2"
+merlin = "3"
 rand = "0.7"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"