diff --git a/apps/backend/requirements-dev.txt b/apps/backend/requirements-dev.txt
index 7a889e8..f842f5b 100644
--- a/apps/backend/requirements-dev.txt
+++ b/apps/backend/requirements-dev.txt
@@ -1,7 +1,7 @@
 # Test-only. Kept out of requirements.txt so the runtime image does not
 # ship a test framework.
-pytest>=8.0.0,<9.0.0
+pytest>=9.1.1,<10.0.0
 
 # A websocket regression tends to block a receive rather than raise. Without a
 # hard per-test cap, that hangs CI instead of failing it.
-pytest-timeout>=2.3.0,<3.0.0
+pytest-timeout>=2.4.0,<3.0.0
diff --git a/apps/backend/requirements.txt b/apps/backend/requirements.txt
index a61d796..ae4f0c0 100644
--- a/apps/backend/requirements.txt
+++ b/apps/backend/requirements.txt
@@ -1,7 +1,7 @@
-anyio>=4.0.0,<5.0.0
-asyncpg>=0.29.0,<1.0.0
-fastapi>=0.115.0,<1.0.0
-httpx>=0.27.0,<1.0.0
-pyjwt[crypto]>=2.9.0,<3.0.0
-python-dotenv>=1.0.0,<2.0.0
-uvicorn[standard]>=0.30.0,<1.0.0
+anyio>=4.15.1,<5.0.0
+asyncpg>=0.31.0,<1.0.0
+fastapi>=0.141.1,<1.0.0
+httpx>=0.28.1,<1.0.0
+pyjwt[crypto]>=2.14.0,<3.0.0
+python-dotenv>=1.2.3,<2.0.0
+uvicorn[standard]>=0.53.0,<1.0.0