diff --git a/requirements-dev.txt b/requirements-dev.txt
index 298cd24f1..7f96464c3 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -9,7 +9,12 @@ pytest-timeout>=2.4.0
 # run, and uses recorded durations on subsequent runs (.test_durations).
 pytest-split>=0.9.0
 httpx>=0.27.0
-ruff>=0.8.0
+# Exact pin, deliberately. A floor lets a contributor's older ruff enforce rules
+# the current one has retired (UP038 was removed — PEP 604 in isinstance() is
+# slower than the tuple form), and lets `format --check` disagree between
+# machines. CI's lint job installs this exact line, so local == CI. Bump on
+# purpose, not by resolution order.
+ruff==0.15.20
 pre-commit>=4.0
 
 # Required by pyftpdlib TLS_FTPHandler for mock FTP server tests
diff --git a/requirements.txt b/requirements.txt
index b62a71459..1937f81d3 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -14,7 +14,13 @@ fastapi>=0.109.0,<0.136.0
 uvicorn[standard]>=0.27.0
 
 # Database
-sqlalchemy>=2.0.0
+# 2.0.38 is a hard floor, not a preference: it changed the aiosqlite dialect's
+# default pool for file databases from NullPool to AsyncAdaptedQueuePool.
+# core/database._create_engine() passes pool_size/max_overflow on the SQLite
+# branch, which NullPool rejects — on <=2.0.37 every SQLite install (and the
+# test suite, which imports the module-level engine) dies at import with
+# "Invalid argument(s) 'pool_size','max_overflow' sent to create_engine()".
+sqlalchemy>=2.0.38
 aiosqlite>=0.19.0
 asyncpg>=0.29.0
 greenlet>=3.0.0
@@ -146,6 +152,9 @@ numpy>=1.24.0
 pytest>=9.0.3
 pytest-asyncio>=0.23.0
 httpx>=0.26.0
-ruff>=0.2.0
+# Lint/format is pinned exactly in requirements-dev.txt — that file is the
+# source of truth for the version CI enforces. This floor only keeps `ruff`
+# importable for anyone who installs the runtime file alone.
+ruff>=0.8.0
 
 pillow>=12.2.0