diff --git a/pyproject.toml b/pyproject.toml
index db96fee..a113af2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,8 +7,8 @@ license = { text = "Apache-2.0" }
 
 dependencies = [
   "fastapi==0.141.1",
-  "uvicorn[standard]==0.52.1",
-  "pydantic==2.13.4",
+  "uvicorn[standard]==0.52.4",
+  "pydantic==2.13.5",
   "pydantic-settings==2.15.0",
   "SQLAlchemy==2.0.52",
   "alembic==1.19.1",
@@ -20,16 +20,16 @@ dependencies = [
   # `deploy/open-observatory-refine.service`. Dependabot proposed 2.5.2
   # because nothing declares that constraint at the top level; this comment
   # and the pin are the constraint.
-  "numpy==2.4.6",
+  "numpy==2.5.2",
   "soundfile==0.14.0",
-  "typer==0.27.1",
+  "typer==0.27.2",
   # Pinned, not left to typer's own `click>=8.0.0` range. click 8.2 changed
   # `Parameter.make_metavar()` to require a `ctx` argument; typer 0.15.1 still
   # calls it with none, so any fresh install resolving click >=8.2 makes every
   # `oo ... --help` die with a TypeError before printing anything. Found on
   # 2026-08-08 with click 8.4.2 -- on this laptop AND on the live station, so
   # the operator CLI documented in HANDOVER.md was already broken there.
-  "click==8.4.2",
+  "click==8.5.0",
   "rich==15.0.0",
   "structlog==26.1.0",
   "prometheus-client==0.26.0",
@@ -49,26 +49,26 @@ dependencies = [
 # ALSA capture on the target device.
 alsa = ["pyalsaaudio==0.11.0"]
 # Preferred high-quality polyphase resampler. Falls back to scipy when absent.
-resample = ["soxr==1.1.0", "scipy==1.18.0"]
+resample = ["soxr==1.1.0", "scipy==1.18.1"]
 # TFLite inference for the BirdNET adapter. `tflite-runtime` has no cp312
 # aarch64 wheel; ai-edge-litert is its maintained successor and does.
 birdnet = ["ai-edge-litert==2.2.0"]
 # PostgreSQL production profile (ADR-007).
-postgres = ["psycopg[binary]==3.3.4"]
+postgres = ["psycopg[binary]==3.3.5"]
 dev = [
   "pytest==9.1.1",
   "pytest-asyncio==1.4.0",
   "httpx==0.28.1",
-  "ruff==0.16.2",
-  "mypy==2.3.0",
+  "ruff==0.16.5",
+  "mypy==2.3.1",
   # Validates real emitted events against schemas/detection-event.schema.json
   # (tests/test_mqtt_schema.py) so the envelope cannot drift unnoticed again.
   "jsonschema==4.26.0",
-  "hypothesis==6.165.5",
+  "hypothesis==6.167.1",
   # Client for scripts/probe_display_channel.py, which measures what
   # /api/v1/display actually costs on the wire against a real station (ADR-038).
   # Not a runtime dependency: the server side is Starlette's own WebSocket.
-  "websockets==17.0.1",
+  "websockets==17.1",
   # scripts/serial_capture.py. `pio device monitor` needs a tty, which an agent
   # or a CI job does not have, and reading the display's serial output is the
   # only evidence that the firmware works.