diff --git a/requirements.txt b/requirements.txt
index e3e44f2..3c28811 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -15,7 +15,7 @@ uvicorn==0.49.0
 # exchanged for a short-lived installation token. cryptography backs RS256.
 PyJWT==2.13.0
 # >=48.0.1: earlier wheels statically link a vulnerable OpenSSL (GHSA-537c-gmf6-5ccf).
-cryptography==48.0.1
+cryptography==49.0.0
 # Runtime HTTP client for the agent-team P3 App-dispatch seams
 # (github_app.mint_installation_token, dispatcher.app_workflow_dispatcher,
 # dispatcher.app_run_locator) and the CI fetcher/transport. Pinned first-class