diff --git a/requirements.txt b/requirements.txt
index 1ebcc92..9775edc 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -6,7 +6,7 @@ lyricsgenius==3.12.2
 # PYSEC-2026-1448 / PYSEC-2026-3002, which are in libsodium's ed25519 point
 # validation — voice only uses its secretbox/AEAD ciphers, so the bot never
 # reaches that code. Lift the pin once discord.py allows 1.6.2.
-PyNaCl==1.5.0
+PyNaCl==1.6.2
 python-dotenv==1.2.2
 aiohttp==3.14.3
 # Never imported here: yt-dlp uses it for browser impersonation, which some