diff --git a/CHANGELOG.md b/CHANGELOG.md
index 90ecdb0..f850faf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,6 +10,14 @@ pre-1.0 scheme; dates are when the change reached `main`.
   operations runbook, security model, and API reference, with a docs index and
   a `CONTRIBUTING` guide.
 
+### Security
+- Updated dependencies to clear published advisories against the pinned
+  versions: Authlib 1.4.0 → 1.7.2 (signature-verification bypass in JWS JWK
+  header handling, CVE-2026-27962, plus nine further advisories on the OIDC
+  path), python-multipart 0.0.20 → 0.0.32 (denial-of-service and parameter
+  smuggling in multipart parsing, reachable from the public upload form), and
+  Jinja2 3.1.5 → 3.1.6 (CVE-2025-27516).
+
 ## 2026-06-23
 
 ### Added
diff --git a/requirements.txt b/requirements.txt
index 6ebda8b..9546c53 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,11 +3,11 @@ fastapi==0.115.6
 uvicorn[standard]==0.34.0
 sqlalchemy==2.0.36
 psycopg2-binary==2.9.10
-authlib==1.4.0
+authlib==1.7.2
 httpx==0.28.1
 itsdangerous==2.2.0
-jinja2==3.1.5
-python-multipart==0.0.20
+jinja2==3.1.6
+python-multipart==0.0.32
 pydantic==2.10.4
 pydantic-settings==2.7.1
 ua-parser==0.18.0