diff --git a/core/Cargo.toml b/core/Cargo.toml
index 8950e64..c64950e 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -287,7 +287,7 @@ getrandom = { version = "0.4", optional = true }
 bitflags = { version = "2.13", optional = true }
 parking_lot = { version = "0.12", optional = true }  # Fast mutex for buffer pool
 arc-swap = { version = "1", optional = true }        # Lock-free atomic swap for the CryptoState rekey path (Phase 1.5)
-lz4_flex = { version = "0.13.1", optional = true }   # Fastest pure-Rust LZ4 (safe, no C bindings); >=0.13.1 floor avoids yanked 0.11.5 (RUSTSEC-2026-0041)
+lz4_flex = { version = "0.13.1", optional = true }   # Fastest pure-Rust LZ4 (safe, no C bindings); >=0.14.0 floor avoids yanked 0.11.5 (RUSTSEC-2026-0041)
 # zstd pinned to a release version. Optional (gated by `compression-zstd`
 # feature) so WASM / embedded builds can opt out of the C bindings in
 # zstd-sys, falling back to lz4_flex.