diff --git a/services/api/requirements.in b/services/api/requirements.in
index 1cd60b64..7d00e6d8 100644
--- a/services/api/requirements.in
+++ b/services/api/requirements.in
@@ -11,7 +11,7 @@ fastapi>=0.115
 uvicorn[standard]>=0.30
 sqlalchemy>=2.0
 pydantic>=2.7
-python-multipart>=0.0.9   # file uploads (attachments)
+python-multipart>=0.0.32   # file uploads (attachments)
 boto3>=1.34               # MinIO/S3 object storage (range reads); lazy-imported
 psycopg[binary]>=3.1      # Postgres driver (prod). Locked here so `--require-hashes` covers it too.