diff --git a/Cargo.lock b/Cargo.lock
index aa8f899fa..04f15c12b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7277,11 +7277,11 @@ checksum = "2896d95c02a80c6d6a5d6e953d479f5ddf2dfdb6a244441010e373ac0fb88971"
 
 [[package]]
 name = "ulid"
-version = "1.2.1"
+version = "3.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "470dbf6591da1b39d43c14523b2b469c86879a53e8b758c8e090a470fe7b1fbe"
+checksum = "947dde63b6d514cc5e044edad4e0ca7261afd1099d16c83d942cb2b2f348689c"
 dependencies = [
- "rand 0.9.4",
+ "rand 0.10.3",
  "serde",
  "uuid",
  "web-time",
diff --git a/Cargo.toml b/Cargo.toml
index 738af8abe..4c25ef42c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -703,7 +703,7 @@ version = "2.1.3"
 
 # ULID support
 [workspace.dependencies.ulid]
-version = "1.2.1"
+version = "3.0.0"
 features = ["serde", "uuid"]
 
 # UUID support
diff --git a/clippy.toml b/clippy.toml
index 3482c2f0d..a0368bf62 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -9,10 +9,10 @@ doc-valid-idents = ["OpenID", "OAuth", "UserInfo", "..", "PostgreSQL", "SQLite"]
 disallowed-methods = [
     { path = "rand::rng", reason = "do not create rngs on the fly, pass them as parameters" },
     { path = "chrono::Utc::now", reason = "source the current time from the clock instead" },
-    # ulid's own constructors/accessors below either use ulid's (separate) `rand`
-    # or its `std`-only SystemTime API. Use `mas_data_model::UlidExt` instead so our
-    # ULID generation stays on the workspace `rand` and `chrono`.
-    { path = "ulid::Ulid::new", reason = "use mas_data_model::UlidExt::from_datetime_with_rng instead" },
+    # ulid's own constructors/accessors below either create their own RNG or use
+    # `SystemTime`. Use `mas_data_model::UlidExt` instead so ULID generation takes an
+    # injected RNG and `chrono` timestamps.
+    { path = "ulid::Ulid::generate", reason = "use mas_data_model::UlidExt::from_datetime_with_rng instead" },
     { path = "ulid::Ulid::with_source", reason = "use mas_data_model::UlidExt::from_datetime_with_rng instead" },
     { path = "ulid::Ulid::from_datetime", reason = "use mas_data_model::UlidExt::from_datetime_with_rng instead" },
     { path = "ulid::Ulid::from_datetime_with_source", reason = "use mas_data_model::UlidExt::from_datetime_with_rng instead" },
diff --git a/deny.toml b/deny.toml
index 69e100642..578e59d4d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -100,7 +100,7 @@ skip = [
     { name = "rand_chacha", version = "0.3.1" },
     { name = "rand_core", version = "0.6.4" },
     { name = "getrandom", version = "0.2.16" },
-    # ...and opentelemetry_sdk, sentry and ulid pull the 0.9 generation
+    # ...and opentelemetry_sdk and sentry pull the 0.9 generation
     { name = "rand", version = "0.9.4" },
     { name = "rand_chacha", version = "0.9.0" },
     { name = "rand_core", version = "0.9.3" },