diff --git a/services/ai-backend/pyproject.toml b/services/ai-backend/pyproject.toml
index 340bb3b5..f94de526 100644
--- a/services/ai-backend/pyproject.toml
+++ b/services/ai-backend/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools==83.0.0", "wheel==0.47.0"]
+requires = ["setuptools==83.0.0", "wheel==0.48.0"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -8,42 +8,42 @@ version = "0.1.0"
 description = "Agent runtime foundation for the enterprise work surface"
 requires-python = ">=3.13"
 dependencies = [
-  "deepagents==0.7.4",
-  "ddgs==9.14.4",
+  "deepagents==0.7.19",
+  "ddgs==9.16.0",
   "fastapi==0.141.1",
-  "langchain==1.3.14",
-  "langchain-openai==1.4.1",
-  "langchain-anthropic==1.5.4",
-  "langchain-google-genai==4.3.2",
-  "litellm==1.95.0",
-  "langgraph==1.2.10",
+  "langchain==1.4.2",
+  "langchain-openai==1.6.6",
+  "langchain-anthropic==1.7.4",
+  "langchain-google-genai==4.4.0",
+  "litellm==1.102.1",
+  "langgraph==1.2.12",
   # Upstream authority for provider model metadata, pricing, and preflight
   # token counting. Desktop packages it into the prebuilt runtime; it is never
   # replaced by a locally-maintained per-model catalog.
-  "litellm==1.95.0",
+  "litellm==1.102.1",
   # SQLite-backed LangGraph checkpointer for the single_user_desktop file store
   # (durable graph/approval continuation across worker restart). Desktop path
   # only; the in-memory backend keeps InMemorySaver. Pulls in aiosqlite.
   "langgraph-checkpoint-sqlite==3.1.1",
   "openai==2.53.0",
   "anthropic==0.120.2",
-  "pydantic==2.13.4",
-  "pydantic-settings==2.14.2",
-  "python-dotenv==1.2.2",
+  "pydantic==2.13.5",
+  "pydantic-settings==2.15.0",
+  "python-dotenv==1.2.3",
   "python-multipart==0.0.32",
-  "uvicorn==0.52.1",
-  "gunicorn==26.0.0",
+  "uvicorn==0.54.0",
+  "gunicorn==26.2.0",
   "httpx==0.28.1",
   # Retry/backoff for transient tool failures (agent_runtime.capabilities
   # .retrying_tool). Already resolved transitively via langchain-core; declared
   # here because it is now imported directly. Pin matches requirements.txt.
   "tenacity==9.1.4",
   "pyyaml==6.0.3",
-  "opentelemetry-api==1.44.0",
-  "opentelemetry-sdk==1.44.0",
-  "opentelemetry-exporter-otlp-proto-grpc==1.44.0",
-  "opentelemetry-instrumentation-fastapi==0.65b0",
-  "opentelemetry-instrumentation-httpx==0.65b0",
+  "opentelemetry-api==1.45.0",
+  "opentelemetry-sdk==1.45.0",
+  "opentelemetry-exporter-otlp-proto-grpc==1.45.0",
+  "opentelemetry-instrumentation-fastapi==0.66b0",
+  "opentelemetry-instrumentation-httpx==0.66b0",
 ]
 
 [project.optional-dependencies]
diff --git a/services/ai-backend/requirements.in b/services/ai-backend/requirements.in
index 0df5050d..d1610b43 100644
--- a/services/ai-backend/requirements.in
+++ b/services/ai-backend/requirements.in
@@ -22,22 +22,22 @@ fastapi==0.141.1
 # `from starlette import status` is used directly across runtime_api/ and
 # runtime_adapters/. FastAPI happens to require it; the import is still ours.
 starlette==1.4.1
-uvicorn==0.52.1
-gunicorn==26.0.0
+uvicorn==0.54.0
+gunicorn==26.2.0
 httpx==0.28.1
 python-multipart==0.0.32
-pydantic==2.13.4
-pydantic-settings==2.14.2
-python-dotenv==1.2.2
+pydantic==2.13.5
+pydantic-settings==2.15.0
+python-dotenv==1.2.3
 PyYAML==6.0.3
 
 # -- agent runtime ------------------------------------------------------------
-deepagents==0.7.4
-langchain==1.3.14
-langchain-openai==1.4.1
-langchain-anthropic==1.5.4
-langchain-google-genai==4.3.2
-langgraph==1.2.10
+deepagents==0.7.19
+langchain==1.4.2
+langchain-openai==1.6.6
+langchain-anthropic==1.7.4
+langchain-google-genai==4.4.0
+langgraph==1.2.12
 # SQLite-backed LangGraph checkpointer for the single_user_desktop file store
 # (durable graph/approval continuation across worker restart). Desktop path
 # only; postgres/in-memory keep InMemorySaver.
@@ -55,8 +55,8 @@ openai==2.53.0
 anthropic==0.120.2
 # Upstream authority for provider model metadata, pricing, and preflight token
 # counting. Never replaced by a locally-maintained per-model catalog.
-litellm==1.95.0
-ddgs==9.14.4
+litellm==1.102.1
+ddgs==9.16.0
 # Main-content extraction for `web_search` (PRD local-search-extraction, S1).
 # Search gives us four URLs; this turns each page into the article text a
 # snippet-anchored window can be cut from. Without it the whole extraction path
@@ -73,11 +73,11 @@ cryptography==50.0.0
 wcmatch==11.0
 
 # -- telemetry ----------------------------------------------------------------
-opentelemetry-api==1.44.0
-opentelemetry-sdk==1.44.0
-opentelemetry-exporter-otlp-proto-grpc==1.44.0
-opentelemetry-instrumentation-fastapi==0.65b0
-opentelemetry-instrumentation-httpx==0.65b0
+opentelemetry-api==1.45.0
+opentelemetry-sdk==1.45.0
+opentelemetry-exporter-otlp-proto-grpc==1.45.0
+opentelemetry-instrumentation-fastapi==0.66b0
+opentelemetry-instrumentation-httpx==0.66b0
 
 # Deliberately ABSENT — boto3. `persistence/_aws_kms_client.py` imports it
 # lazily so a deployment that does not use AWS KMS never carries the SDK; one