diff --git a/requirements.txt b/requirements.txt
index 3984d070..659d3c02 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 certifi
-idna==3.7
+idna>=3.7,<4  # CVE-2026-45409 fix ships in 3.15; allow security patches (#481)
 cycler
 kiwisolver>=1.3.1
 matplotlib