diff --git a/CHANGELOG.md b/CHANGELOG.md
index 53eff671..eb5f6535 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -122,6 +122,12 @@ and stale roadmap entries have been removed from the public documentation set.
   `Image::decode_region_rows_for_integer_output_with_context` and
   `ComponentRowSink` expose this for other callers.
 
+- Security: the lockfiles move to libz-sys 1.1.31, which fixes
+  RUSTSEC-2026-0418. Its build script printed the build environment into
+  `target/` when built with cc 1.6 or later on Unix. J2K's locked builds use
+  cc 1.2 and were not affected. `cargo install --locked j2k-cli` now builds
+  the fixed version.
+
 ## [0.13.0] - 2026-10-26
 
 - Migration from 0.12.0: exhaustive native `EncodeOptions` literals must add
diff --git a/Cargo.lock b/Cargo.lock
index 7b299514..347c680e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3066,9 +3066,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.29"
+version = "1.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
+checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/crates/j2k-t803/fuzz/Cargo.lock b/crates/j2k-t803/fuzz/Cargo.lock
index 200a6c23..92a3db00 100644
--- a/crates/j2k-t803/fuzz/Cargo.lock
+++ b/crates/j2k-t803/fuzz/Cargo.lock
@@ -390,9 +390,9 @@ checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
 [[package]]
 name = "libz-sys"
-version = "1.1.29"
+version = "1.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
+checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2"
 dependencies = [
  "cc",
  "pkg-config",
diff --git a/crates/j2k-tilecodec/fuzz/Cargo.lock b/crates/j2k-tilecodec/fuzz/Cargo.lock
index 407a3e73..fe39e786 100644
--- a/crates/j2k-tilecodec/fuzz/Cargo.lock
+++ b/crates/j2k-tilecodec/fuzz/Cargo.lock
@@ -126,9 +126,9 @@ dependencies = [
 
 [[package]]
 name = "libz-sys"
-version = "1.1.29"
+version = "1.1.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85bc9657773828b90eeb625adff10eeac83cc21bbfd8e23a03eaa8a33c9e28d9"
+checksum = "ff20308ecabd635a2dc1dd5834a86c462cca20efba1d5d3ddab1f8aea3455cb2"
 dependencies = [
  "cc",
  "pkg-config",