diff --git a/mflix/server/python-fastapi/requirements.in b/mflix/server/python-fastapi/requirements.in
index baf2bf5..d46b4d9 100644
--- a/mflix/server/python-fastapi/requirements.in
+++ b/mflix/server/python-fastapi/requirements.in
@@ -66,3 +66,4 @@ aiohttp>=3.13.3         # Transitive dep via voyageai
 orjson>=3.11.7          # Transitive dep via langsmith (CVE fix)
 langchain-core>=1.2.11  # Transitive dep via langchain-text-splitters (CVE-2026-26013 fix)
 pillow>=12.1.1          # Transitive dep via voyageai (CVE-2026-25990 fix)
+requests>=2.33.0        # Transitive dep via langsmith/voyageai (CVE-2026-25645 fix)
diff --git a/mflix/server/python-fastapi/requirements.txt b/mflix/server/python-fastapi/requirements.txt
index 9082a76..585daa3 100644
--- a/mflix/server/python-fastapi/requirements.txt
+++ b/mflix/server/python-fastapi/requirements.txt
@@ -171,8 +171,9 @@ pyyaml==6.0.3
     #   huggingface-hub
     #   langchain-core
     #   uvicorn
-requests==2.32.5
+requests==2.33.0
     # via
+    #   -r requirements.in
     #   langsmith
     #   requests-toolbelt
     #   voyageai