diff --git a/requirements.txt b/requirements.txt
index 45f8201..a53082d 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,10 @@
 # LeoCRM v1.0 - Production Dependencies
 
 # Web framework
-fastapi>=0.111.0,<0.116
+# fastapi 0.141 + starlette 1.3.1: fixes 9 known starlette CVEs
+# (PYSEC-2026-161/248/249/1941/1942/2280/2281) — see PROGRESS.md I-G-1
+fastapi>=0.141.1,<0.142
+starlette>=1.3.1,<1.4
 uvicorn[standard]>=0.29.0
 python-multipart>=0.0.7
 httpx>=0.27