diff --git a/Cargo.toml b/Cargo.toml
index 7d427148..3f00977f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -35,6 +35,7 @@ serde_html_form = "0.2.0"
 serde_json = "1.0.87"
 thiserror = "1.0.37"
 tracing = { version = "0.1.37", default-features = false, features = ["std"] }
+url = { version = "2.5.0" }
 web-time = "1.1.0"
 
 [profile.dev]
diff --git a/crates/ruma-common/Cargo.toml b/crates/ruma-common/Cargo.toml
index 73c6bc99..4cfa68c6 100644
--- a/crates/ruma-common/Cargo.toml
+++ b/crates/ruma-common/Cargo.toml
@@ -75,7 +75,7 @@ serde_json = { workspace = true, features = ["raw_value"] }
 thiserror = { workspace = true }
 time = "0.3.34"
 tracing = { workspace = true, features = ["attributes"] }
-url = "2.2.2"
+url = { workspace = true }
 uuid = { version = "1.0.0", optional = true, features = ["v4"] }
 web-time = { workspace = true }
 wildmatch = "2.0.0"
diff --git a/crates/ruma-events/Cargo.toml b/crates/ruma-events/Cargo.toml
index 493636b3..b0b971e0 100644
--- a/crates/ruma-events/Cargo.toml
+++ b/crates/ruma-events/Cargo.toml
@@ -72,7 +72,7 @@ serde = { workspace = true }
 serde_json = { workspace = true, features = ["raw_value"] }
 thiserror = { workspace = true }
 tracing = { workspace = true, features = ["attributes"] }
-url = "2.2.2"
+url = { workspace = true }
 wildmatch = "2.0.0"
 
 # dev-dependencies can't be optional, so this is a regular dependency