diff --git a/pyproject.toml b/pyproject.toml
index f625499f..f2420416 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,7 +9,12 @@ repository = 'https://github.com/Olen/Spond'
 
 [tool.poetry.dependencies]
 python = ">=3.11"
-aiohttp = ">=3.8.5"
+# Floor is a security boundary, not a feature requirement: everything below
+# 3.14.3 carries known advisories in the HTTP parsers, up to and including a
+# high-severity out-of-bounds read (CVE-2026-69244). As a library we publish
+# this range to downstream installs, so it must not resolve to a vulnerable
+# aiohttp. Don't lower it without checking the advisories first.
+aiohttp = ">=3.14.3"
 
 [tool.poetry.group.dev.dependencies]
 # Constraint on `python` is required: pdoc's transitive `markdown2` declares