diff --git a/git-checks/Cargo.toml b/git-checks/Cargo.toml
index 80c076f472f3e1169fddceefd8906a6da350c6a4..d0dcf7d273872a10adcd595580ead972b41f85a9 100644
--- a/git-checks/Cargo.toml
+++ b/git-checks/Cargo.toml
@@ -24,8 +24,8 @@ lazy_static = "^1.1"
 log = "~0.4.4"
 rayon = "^1.5"
 thiserror = "^2"
-hickory-proto = "0.25.0-alpha.5"
-hickory-resolver = { version = "0.25.0-alpha.5", default-features = false, features = ["system-config", "tokio-runtime"] }
+hickory-proto = "0.25.0"
+hickory-resolver = { version = "0.25.0", default-features = false, features = ["system-config", "tokio"] }
 ttl_cache = "~0.5"
 wait-timeout = "~0.2"
 
@@ -49,6 +49,8 @@ url = "^2.5.4"
 # Avoid transitive dependencies on `failure` and `atty`
 web-sys = "~0.3.26"
 bumpalo = "^3.11.1"
+# Avoid https://rustsec.org/advisories/RUSTSEC-2025-0009
+ring = "0.17.12"
 
 [features]
 default = []
diff --git a/git-checks/src/valid_name.rs b/git-checks/src/valid_name.rs
index b52bd3eac91c4f26c1c38830a3f11a25fef4454b..5094002d311d8b60fbb0440449b3d38cfb75350a 100644
--- a/git-checks/src/valid_name.rs
+++ b/git-checks/src/valid_name.rs
@@ -64,7 +64,8 @@ const DEFAULT_TTL_CACHE_MISS_DURATION: Duration = Duration::from_secs(5 * 60);
 
 lazy_static! {
     // DNS resolver.
-    static ref DNS_RESOLVER: Result<Resolver<TokioConnectionProvider>, ResolveError> = Resolver::tokio_from_system_conf()
+    static ref DNS_RESOLVER: Result<Resolver<TokioConnectionProvider>, ResolveError> = Resolver::builder_tokio()
+        .map(|builder| builder.build())
         .map_err(|err| {
             error!(
                 target: "git-checks/valid_name",