diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml
index f164d8538..1d9a54a0d 100644
--- a/actix-http/Cargo.toml
+++ b/actix-http/Cargo.toml
@@ -132,7 +132,7 @@ h2 = { version = "0.3.26", optional = true }
 # websockets
 local-channel = { version = "0.1", optional = true }
 base64 = { version = "0.22", optional = true }
-rand = { version = "0.8", optional = true }
+rand = { version = "0.9", optional = true }
 sha1 = { version = "0.10", optional = true }
 
 # openssl/rustls
diff --git a/actix-http/tests/test_server.rs b/actix-http/tests/test_server.rs
index e93d35598..6f273ef33 100644
--- a/actix-http/tests/test_server.rs
+++ b/actix-http/tests/test_server.rs
@@ -16,6 +16,7 @@ use actix_utils::future::{err, ok, ready};
 use bytes::Bytes;
 use derive_more::derive::{Display, Error};
 use futures_util::{stream::once, FutureExt as _, StreamExt as _};
+use rand::Rng as _;
 use regex::Regex;
 
 #[actix_rt::test]
@@ -164,7 +165,10 @@ async fn chunked_payload() {
 
         for chunk_size in chunk_sizes.iter() {
             let mut bytes = Vec::new();
-            let random_bytes: Vec<u8> = (0..*chunk_size).map(|_| rand::random::<u8>()).collect();
+            let random_bytes = rand::rng()
+                .sample_iter(rand::distr::StandardUniform)
+                .take(*chunk_size)
+                .collect::<Vec<_>>();
 
             bytes.extend(format!("{:X}\r\n", chunk_size).as_bytes());
             bytes.extend(&random_bytes[..]);
diff --git a/actix-multipart/Cargo.toml b/actix-multipart/Cargo.toml
index 62b53eb79..c0e62d8aa 100644
--- a/actix-multipart/Cargo.toml
+++ b/actix-multipart/Cargo.toml
@@ -50,7 +50,7 @@ local-waker = "0.1"
 log = "0.4"
 memchr = "2.5"
 mime = "0.3"
-rand = "0.8"
+rand = "0.9"
 serde = "1"
 serde_json = "1"
 serde_plain = "1"
diff --git a/actix-multipart/src/test.rs b/actix-multipart/src/test.rs
index 7dec85f8e..b0e907266 100644
--- a/actix-multipart/src/test.rs
+++ b/actix-multipart/src/test.rs
@@ -5,10 +5,7 @@ use actix_web::{
     web::{BufMut as _, Bytes, BytesMut},
 };
 use mime::Mime;
-use rand::{
-    distributions::{Alphanumeric, DistString as _},
-    thread_rng,
-};
+use rand::distr::{Alphanumeric, SampleString as _};
 
 const CRLF: &[u8] = b"\r\n";
 const CRLF_CRLF: &[u8] = b"\r\n\r\n";
@@ -64,7 +61,7 @@ pub fn create_form_data_payload_and_headers(
     content_type: Option<Mime>,
     file: Bytes,
 ) -> (Bytes, HeaderMap) {
-    let boundary = Alphanumeric.sample_string(&mut thread_rng(), 32);
+    let boundary = Alphanumeric.sample_string(&mut rand::rng(), 32);
 
     create_form_data_payload_and_headers_with_boundary(
         &boundary,
diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml
index f4159cf27..f7d6f56d2 100644
--- a/actix-web/Cargo.toml
+++ b/actix-web/Cargo.toml
@@ -180,7 +180,7 @@ criterion = { version = "0.5", features = ["html_reports"] }
 env_logger = "0.11"
 flate2 = "1.0.13"
 futures-util = { version = "0.3.17", default-features = false, features = ["std"] }
-rand = "0.8"
+rand = "0.9"
 rcgen = "0.13"
 rustls-pemfile = "2"
 serde = { version = "1", features = ["derive"] }
diff --git a/actix-web/tests/test_server.rs b/actix-web/tests/test_server.rs
index 960cf1e2b..f13aa3cfd 100644
--- a/actix-web/tests/test_server.rs
+++ b/actix-web/tests/test_server.rs
@@ -25,7 +25,7 @@ use openssl::{
     ssl::{SslAcceptor, SslMethod},
     x509::X509,
 };
-use rand::{distributions::Alphanumeric, Rng as _};
+use rand::distr::{Alphanumeric, SampleString as _};
 
 mod utils;
 
@@ -188,11 +188,7 @@ async fn body_gzip_large() {
 
 #[actix_rt::test]
 async fn test_body_gzip_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(70_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 70_000);
     let srv_data = data.clone();
 
     let srv = actix_test::start_with(actix_test::config().h1(), move || {
@@ -432,11 +428,7 @@ async fn test_zstd_encoding() {
 
 #[actix_rt::test]
 async fn test_zstd_encoding_large() {
-    let data = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(320_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 320_000);
 
     let srv = actix_test::start_with(actix_test::config().h1(), || {
         App::new().service(
@@ -529,11 +521,7 @@ async fn test_gzip_encoding_large() {
 
 #[actix_rt::test]
 async fn test_reading_gzip_encoding_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(60_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 60_000);
 
     let srv = actix_test::start_with(actix_test::config().h1(), || {
         App::new().service(web::resource("/").route(web::to(move |body: Bytes| async {
@@ -599,11 +587,7 @@ async fn test_reading_deflate_encoding_large() {
 
 #[actix_rt::test]
 async fn test_reading_deflate_encoding_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(160_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 160_000);
 
     let srv = actix_test::start_with(actix_test::config().h1(), || {
         App::new().service(web::resource("/").route(web::to(move |body: Bytes| async {
@@ -648,11 +632,7 @@ async fn test_brotli_encoding() {
 
 #[actix_rt::test]
 async fn test_brotli_encoding_large() {
-    let data = rand::thread_rng()
-        .sample_iter(&Alphanumeric)
-        .take(320_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 320_000);
 
     let srv = actix_test::start_with(actix_test::config().h1(), || {
         App::new().service(
@@ -737,11 +717,7 @@ mod plus_rustls {
 
     #[actix_rt::test]
     async fn test_reading_deflate_encoding_large_random_rustls() {
-        let data = rand::thread_rng()
-            .sample_iter(&Alphanumeric)
-            .take(160_000)
-            .map(char::from)
-            .collect::<String>();
+        let data = Alphanumeric.sample_string(&mut rand::rng(), 160_000);
 
         let srv = actix_test::start_with(actix_test::config().rustls_0_23(tls_config()), || {
             App::new().service(web::resource("/").route(web::to(|bytes: Bytes| async {
diff --git a/awc/Cargo.toml b/awc/Cargo.toml
index d6626f906..e2e2bcd17 100644
--- a/awc/Cargo.toml
+++ b/awc/Cargo.toml
@@ -116,7 +116,7 @@ log =" 0.4"
 mime = "0.3"
 percent-encoding = "2.1"
 pin-project-lite = "0.2"
-rand = "0.8"
+rand = "0.9"
 serde = "1.0"
 serde_json = "1.0"
 serde_urlencoded = "0.7"
diff --git a/awc/src/ws.rs b/awc/src/ws.rs
index b05063d22..3ce1d286a 100644
--- a/awc/src/ws.rs
+++ b/awc/src/ws.rs
@@ -326,7 +326,7 @@ impl WebsocketsRequest {
 
         // Generate a random key for the `Sec-WebSocket-Key` header which is a base64-encoded
         // (see RFC 4648 §4) value that, when decoded, is 16 bytes in length (RFC 6455 §1.3).
-        let sec_key: [u8; 16] = rand::random();
+        let sec_key = rand::random::<[u8; 16]>();
         let key = BASE64_STANDARD.encode(sec_key);
 
         self.head.headers.insert(
diff --git a/awc/tests/test_client.rs b/awc/tests/test_client.rs
index 76915630f..43c83891a 100644
--- a/awc/tests/test_client.rs
+++ b/awc/tests/test_client.rs
@@ -20,7 +20,7 @@ use base64::prelude::*;
 use bytes::Bytes;
 use cookie::Cookie;
 use futures_util::stream;
-use rand::Rng;
+use rand::distr::{Alphanumeric, SampleString as _};
 
 mod utils;
 
@@ -516,11 +516,7 @@ async fn client_gzip_encoding_large() {
 #[cfg(feature = "compress-gzip")]
 #[actix_rt::test]
 async fn client_gzip_encoding_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(&rand::distributions::Alphanumeric)
-        .take(100_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 100_000);
 
     let srv = actix_test::start(|| {
         App::new().service(web::resource("/").route(web::to(|data: Bytes| async {
@@ -562,11 +558,7 @@ async fn client_brotli_encoding() {
 #[cfg(feature = "compress-brotli")]
 #[actix_rt::test]
 async fn client_brotli_encoding_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(&rand::distributions::Alphanumeric)
-        .take(70_000)
-        .map(char::from)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 70_000);
 
     let srv = actix_test::start(|| {
         App::new().service(web::resource("/").route(web::to(|data: Bytes| async {
@@ -607,11 +599,7 @@ async fn client_deflate_encoding() {
 
 #[actix_rt::test]
 async fn client_deflate_encoding_large_random() {
-    let data = rand::thread_rng()
-        .sample_iter(rand::distributions::Alphanumeric)
-        .map(char::from)
-        .take(70_000)
-        .collect::<String>();
+    let data = Alphanumeric.sample_string(&mut rand::rng(), 70_000);
 
     let srv = actix_test::start(|| {
         App::new().default_service(web::to(|body: Bytes| async {