diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1dcf7f..2756c52 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -41,6 +41,9 @@ pre-1.0 scheme; dates are when the change reached `main`.
   `TRUST_FORWARDED_FOR=false` did not prevent it, because the server was
   rewriting the peer address before the application saw it. That setting is
   replaced by `TRUSTED_PROXIES`.
+- pytest 8.3.4 → 9.1.1 (with pytest-playwright 0.5.2 → 0.8.0, the first release
+  that accepts pytest 9) for CVE-2025-71176, unsafe temporary-directory
+  handling. Test-only — pytest is not installed in the runtime image.
 - An OIDC token that carries no `groups` claim is now refused instead of being
   admitted on the strength of Authentik's application binding. The provider is
   configured to send the claim, so its absence means the configuration has
diff --git a/requirements-dev.txt b/requirements-dev.txt
index b61750e..2837e50 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -1,3 +1,3 @@
 # Test/dev dependencies (not installed in the runtime image).
 -r requirements.txt
-pytest==8.3.4
+pytest==9.1.1
diff --git a/requirements-e2e.txt b/requirements-e2e.txt
index 065ecab..a466eb1 100644
--- a/requirements-e2e.txt
+++ b/requirements-e2e.txt
@@ -1,10 +1,11 @@
 # Browser end-to-end test dependencies (run via the Playwright image; see
 # scripts/run-e2e.sh). Kept separate from the runtime and unit-test deps.
-pytest==8.3.4
+pytest==9.1.1
 # itsdangerous: forge a Starlette session cookie for the authenticated workspace
 # E2E (must match the app's signer).
 itsdangerous==2.2.0
 # Pin Playwright to match the runner image (mcr.microsoft.com/playwright/python
 # tag in scripts/run-e2e.sh / CI installs the matching browser build).
 playwright==1.49.0
-pytest-playwright==0.5.2
+# 0.8.0 is the first release that accepts pytest 9.
+pytest-playwright==0.8.0