diff --git a/requirements.txt b/requirements.txt
index 1ebcc92..31dda91 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -7,7 +7,7 @@ lyricsgenius==3.12.2
 # validation — voice only uses its secretbox/AEAD ciphers, so the bot never
 # reaches that code. Lift the pin once discord.py allows 1.6.2.
 PyNaCl==1.5.0
-python-dotenv==1.2.2
+python-dotenv==1.2.3
 aiohttp==3.14.3
 # Never imported here: yt-dlp uses it for browser impersonation, which some
 # extractors require. Removing it breaks those sites, not an import.