diff --git a/Cargo.lock b/Cargo.lock
index 1b8340e54..716dad989 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4984,7 +4984,7 @@ dependencies = [
  "opentelemetry_sdk 0.32.1",
  "pastey",
  "pctx_code_mode",
- "pem",
+ "pem 4.0.0",
  "process-wrap",
  "pulldown-cmark",
  "rand 0.10.2",
@@ -5232,7 +5232,7 @@ dependencies = [
  "goose-local-inference",
  "goose-provider-types",
  "include_dir",
- "pem",
+ "pem 4.0.0",
  "pkcs1",
  "pkcs8",
  "reqwest 0.13.4",
@@ -6374,7 +6374,7 @@ dependencies = [
  "js-sys",
  "p256",
  "p384",
- "pem",
+ "pem 3.0.6",
  "rand 0.8.6",
  "rsa",
  "serde",
@@ -8013,6 +8013,16 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "pem"
+version = "4.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120"
+dependencies = [
+ "base64 0.23.0",
+ "serde_core",
+]
+
 [[package]]
 name = "pem-rfc7468"
 version = "0.7.0"
@@ -8801,7 +8811,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
 dependencies = [
  "aws-lc-rs",
- "pem",
+ "pem 3.0.6",
  "ring",
  "rustls-pki-types",
  "time",
@@ -10069,7 +10079,7 @@ dependencies = [
  "const-oid 0.9.6",
  "der",
  "digest 0.10.7",
- "pem",
+ "pem 3.0.6",
  "rand_core 0.9.5",
  "sha2 0.10.9",
  "signature",
@@ -10186,7 +10196,7 @@ checksum = "56f034e86c3b8d91b32608c83f4a18939eed32c6ca08d17d2f52b88be365aac6"
 dependencies = [
  "base64 0.22.1",
  "hex",
- "pem",
+ "pem 3.0.6",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -10203,7 +10213,7 @@ dependencies = [
  "const-oid 0.9.6",
  "hex",
  "jiff",
- "pem",
+ "pem 3.0.6",
  "rustls-pki-types",
  "rustls-webpki",
  "serde",
diff --git a/crates/goose-providers/Cargo.toml b/crates/goose-providers/Cargo.toml
index 29862de30..e17e0322f 100644
--- a/crates/goose-providers/Cargo.toml
+++ b/crates/goose-providers/Cargo.toml
@@ -48,7 +48,7 @@ tokio-stream = { workspace = true, features = ["io-util"] }
 tokio-util = { workspace = true, features = ["compat"] }
 url = { workspace = true }
 urlencoding = { workspace = true }
-pem = { version = "3.0.2", default-features = false, features = ["std"], optional = true }
+pem = { version = "4.0.0", default-features = false, features = ["std"], optional = true }
 pkcs1 = { version = "0.7.5", default-features = false, features = ["pkcs8", "std"], optional = true }
 # v0.10 matches the der/const-oid series used by sec1 v0.7 and pkcs1 v0.7; upgrading to v0.11 causes type mismatches across those crates.
 pkcs8 = { version = "0.10", default-features = false, features = ["alloc", "std"], optional = true }
diff --git a/crates/goose/Cargo.toml b/crates/goose/Cargo.toml
index 9d511b40c..04603cab4 100644
--- a/crates/goose/Cargo.toml
+++ b/crates/goose/Cargo.toml
@@ -215,7 +215,7 @@ rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem
 axum-server = { version = "0.8", default-features = false, optional = true }
 aws-lc-rs = { version = "1.17", default-features = false, optional = true }
 openssl = { version = "0.10.66", default-features = false, optional = true }
-pem = { version = "3.0.2", default-features = false, features = ["std"], optional = true }
+pem = { version = "4.0.0", default-features = false, features = ["std"], optional = true }
 
 pctx_code_mode = { version = "0.4.1", default-features = false, optional = true }