diff --git a/pyproject.toml b/pyproject.toml
index ca4726425..bb5ea79a3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -363,6 +363,10 @@ constraint-dependencies = [
     "transformers>=5.5.0",
     # PYSEC-2026-3447 — transitive dependency; fix at 83.0.0
     "setuptools>=83.0.0",
+    # PYSEC-2026-3545/3546/3547 — transitive HTTP/WebSocket parser fixes
+    "aiohttp>=3.14.3",
+    # PYSEC-2026-3552/3553/3554 — PKCS#7 and certificate verification fixes
+    "cryptography>=50.0.0",
 ]
 
 # Pin the project's package index to public PyPI. Without this, `uv lock`
diff --git a/uv.lock b/uv.lock
index 83cfc99dd..c70b4098d 100644
--- a/uv.lock
+++ b/uv.lock
@@ -19,6 +19,8 @@ resolution-markers = [
 
 [manifest]
 constraints = [
+    { name = "aiohttp", specifier = ">=3.14.3" },
+    { name = "cryptography", specifier = ">=50.0.0" },
     { name = "gitpython", specifier = ">=3.1.50" },
     { name = "langsmith", specifier = ">=0.9.0" },
     { name = "lxml-html-clean", specifier = ">=0.4.5" },
@@ -1678,7 +1680,7 @@ wheels = [
 
 [[package]]
 name = "headroom-ai"
-version = "0.33.0"
+version = "0.34.0"
 source = { editable = "." }
 dependencies = [
     { name = "ast-grep-cli" },