diff --git a/workspace/requirements.txt b/workspace/requirements.txt
index ad4b5356..dbb75f8f 100644
--- a/workspace/requirements.txt
+++ b/workspace/requirements.txt
@@ -17,7 +17,7 @@ websockets>=16.0
 # multipart/form-data parser — required for Starlette's Request.form() on
 # /internal/chat/uploads/ingest. Pinned ≥ 0.0.18 because earlier versions
 # had a CVE-2024-53981 (DoS via malformed boundary).
-python-multipart>=0.0.18
+python-multipart>=0.0.27
 
 # Config parsing
 pyyaml>=6.0.3