diff --git a/Cargo.lock b/Cargo.lock
index ea49673a3..eb314ab2e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2986,6 +2986,18 @@ version = "1.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
 
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nkeys"
 version = "0.4.5"
@@ -4613,7 +4625,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.3.4",
+ "getrandom 0.4.3",
  "once_cell",
  "rustix",
  "windows-sys 0.61.2",
@@ -5763,14 +5775,15 @@ dependencies = [
 
 [[package]]
 name = "zip"
-version = "8.6.0"
+version = "9.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
+checksum = "a954114b47a54df49f83d2722814e86b23d4bb1b54a1b90fb7d92b41619ddc22"
 dependencies = [
  "crc32fast",
  "flate2",
  "indexmap",
  "memchr",
+ "nix",
  "typed-path",
  "zopfli",
 ]
diff --git a/tools/ci/Cargo.toml b/tools/ci/Cargo.toml
index 7313ec8fc..165288b69 100644
--- a/tools/ci/Cargo.toml
+++ b/tools/ci/Cargo.toml
@@ -22,4 +22,4 @@ tar = "0.4.46"
 tempfile = "3.27.0"
 tokio = { version = "1.53.1", features = ["fs", "io-util", "macros", "process", "rt-multi-thread", "signal", "sync", "time"] }
 walkdir = "2.5.0"
-zip = { version = "8.6.0", default-features = false, features = ["deflate"] }
+zip = { version = "9.0.4", default-features = false, features = ["deflate"] }
diff --git a/tools/ci/src/desktop.rs b/tools/ci/src/desktop.rs
index 0d8bcb046..5e56269e9 100644
--- a/tools/ci/src/desktop.rs
+++ b/tools/ci/src/desktop.rs
@@ -3358,10 +3358,8 @@ fn velopack_path_lengths(nupkg: &Path, prefix: &Path) -> Result<Vec<ArchivePathL
     let mut entries = Vec::new();
     for index in 0..archive.len() {
         let entry = archive.by_index(index)?;
-        let normalized = entry
-            .name()
-            .trim_start_matches(['/', '\\'])
-            .replace('\\', "/");
+        let name = entry.name()?.into_owned();
+        let normalized = name.trim_start_matches(['/', '\\']).replace('\\', "/");
         let full = if normalized.is_empty() {
             prefix.to_path_buf()
         } else {
@@ -3369,7 +3367,7 @@ fn velopack_path_lengths(nupkg: &Path, prefix: &Path) -> Result<Vec<ArchivePathL
         };
         entries.push(ArchivePathLength {
             length: full.to_string_lossy().len(),
-            name: entry.name().to_string(),
+            name,
         });
     }
     entries.sort_by(|a, b| b.length.cmp(&a.length).then_with(|| a.name.cmp(&b.name)));
@@ -4291,7 +4289,7 @@ fn extract_zip_safely(archive_path: &Path, destination: &Path) -> Result<()> {
         let relative = entry.enclosed_name().ok_or_else(|| {
             anyhow!(
                 "Refusing to extract unsafe archive path '{}' from {}",
-                entry.name(),
+                entry.name().unwrap_or_default(),
                 archive_path.display()
             )
         })?;