diff --git a/Cargo.toml b/Cargo.toml
index 03a1a25bdd..d46b3fa647 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -98,7 +98,7 @@ url = { version = "2.3.1", features = ["serde"] }
 uuid = { version = "1.3.3", default-features = false, features = ["v4"] }
 lasso = { version = "0.7.2", features = ["multi-threaded"] }
 kube.workspace = true
-trust-dns-resolver = { version = "0.21.0", features = ["tokio", "tokio-rustls", "dns-over-https-rustls"] }
+trust-dns-resolver = { version = "0.23.0", features = ["tokio", "tokio-rustls", "dns-over-https-rustls"] }
 async-trait = "0.1.68"
 nom = "7.1.3"
 
diff --git a/deny.toml b/deny.toml
index 91b2fec376..c83f7de876 100644
--- a/deny.toml
+++ b/deny.toml
@@ -30,8 +30,8 @@ default = "allow"
 exceptions = [
     # Each entry is the crate and version constraint, and its specific allow
     # list
-    { name ="webpki-roots", version = "0.23.0", allow = ["MPL-2.0"] },
-    { name ="webpki-roots", version = "0.22.0", allow = ["MPL-2.0"] },
+    { name ="webpki-roots", version = "0.25.0", allow = ["MPL-2.0"] },
+    { name ="webpki-roots", version = "0.23.0", allow = ["MPL-2.0"] }
 ]
 
 [[licenses.clarify]]
diff --git a/src/endpoint/address.rs b/src/endpoint/address.rs
index 743720d794..b23088b672 100644
--- a/src/endpoint/address.rs
+++ b/src/endpoint/address.rs
@@ -23,10 +23,7 @@ use std::{
 
 use once_cell::sync::Lazy;
 use serde::{Deserialize, Serialize};
-use trust_dns_resolver::{
-    name_server::{GenericConnection, GenericConnectionProvider, TokioRuntime},
-    AsyncResolver,
-};
+use trust_dns_resolver::{AsyncResolver, TokioAsyncResolver};
 
 use crate::xds::config::core::v3::{
     address::Address as EnvoyAddress, SocketAddress as EnvoySocketAddress,
@@ -64,9 +61,8 @@ impl EndpointAddress {
     /// Returns the socket address for the endpoint, resolving any DNS entries
     /// if present.
     pub async fn to_socket_addr(&self) -> std::io::Result<SocketAddr> {
-        static DNS: Lazy<
-            AsyncResolver<GenericConnection, GenericConnectionProvider<TokioRuntime>>,
-        > = Lazy::new(|| AsyncResolver::tokio_from_system_conf().unwrap());
+        static DNS: Lazy<TokioAsyncResolver> =
+            Lazy::new(|| AsyncResolver::tokio_from_system_conf().unwrap());
 
         let ip = match &self.host {
             AddressKind::Ip(ip) => *ip,