diff --git a/backend/requirements.in b/backend/requirements.in
index 8d70f5f..ac8e869 100644
--- a/backend/requirements.in
+++ b/backend/requirements.in
@@ -37,5 +37,6 @@ httpx
 # Security floors for transitive dependencies (OSV audit, 2026-10-25).
 certifi>=2026.10.19
 Pillow>=13.0.0
+pyasn1>=0.6.5
 urllib3>=2.8.0
 # msgpack remains constrained to 1.1.2 by signalrcore 1.0.2; see PR security notes.
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 846d915..678741c 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -116,8 +116,9 @@ platformdirs==4.11.3
     #   requests-cache
 pluggy==1.6.0
     # via pytest
-pyasn1==0.6.4
+pyasn1==0.6.5
     # via
+    #   -r requirements.in
     #   pyasn1-modules
     #   python-jose
     #   rsa