diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2e3646c9..214181a0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,12 @@ reasoning attached, in [docs/history/LESSONS_LEARNED.md](docs/history/LESSONS_LE
   plugin's tools, so unloading it afterwards left them registered. And a loader given an
   empty registry used the global one instead, since an empty registry is falsy.
 
+### Security
+
+- **`dnspython` 2.9.2** (CVE-2026-128089) and **`opentelemetry-api` 1.45.2**
+  (CVE-2026-126360). Both come in transitively, through `email-validator` and `fastapi`; the lock
+  was recompiled for these two packages only.
+
 ## [3.6.0] — 2026-11-11
 
 The release of the QP-9 review's open findings (QP-10): R-8 to R-12 and item 13 are fixed,
diff --git a/requirements.txt b/requirements.txt
index a116ab0b..a142e86e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -65,7 +65,7 @@ ddgs==9.16.1
     # via -r requirements.in
 deprecated==1.3.1
     # via limits
-dnspython==2.9.1
+dnspython==2.9.2
     # via email-validator
 email-validator==2.3.0
     # via -r requirements.in
@@ -169,7 +169,7 @@ onnxruntime==1.31.1
     #   pymupdf
 openpyxl==3.1.5
     # via -r requirements.in
-opentelemetry-api==1.45.1
+opentelemetry-api==1.45.2
     # via fastapi
 packaging==26.3
     # via