diff --git a/.github/workflows/deploy-image.yml b/.github/workflows/deploy-image.yml
index 192e87a6..50b54436 100644
--- a/.github/workflows/deploy-image.yml
+++ b/.github/workflows/deploy-image.yml
@@ -44,6 +44,11 @@ jobs:
       - name: Import smoke test
         run: docker run --rm ${{ steps.meta.outputs.tags }} python -c "import sp_validation"
 
+      # The blinding stack is core: this resolves the UNIONS-WL/Smokescreen
+      # fork pin (CCL theory backend only in the closure).
+      - name: Import smokescreen (fork pin resolves)
+        run: docker run --rm ${{ steps.meta.outputs.tags }} python -c "import smokescreen"
+
       # Run the fast test suite against the freshly-built image *before*
       # pushing, so a failing suite blocks publication. The image carries the
       # full stack and the test files (COPY . + editable install), so this
diff --git a/pyproject.toml b/pyproject.toml
index bb1fe413..7297b252 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,7 +9,7 @@ authors = [
 ]
 license = {text = "MIT"}
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.12"
 classifiers = [
     "License :: OSI Approved :: MIT License",
     "Programming Language :: Python :: 3",
@@ -25,6 +25,11 @@ dependencies = [
     "camb>=1.6",
     "clmm",
     "colorama",
+    # Blinding closure (core, no extra): cryptography + sacc here, plus the
+    # Smokescreen fork pin below; pyccl (the theory backend) is already core.
+    # cryptography and sacc are declared explicitly so the core runtime
+    # closure is self-documenting and independent of fork-metadata drift.
+    "cryptography",
     # Track cs_util's develop branch directly (git dependency) rather than a
     # PyPI pin: the two repos are iterating together heavily and cs_util
     # releases are infrequent. This PR's cosmology repoint needs get_cosmo /
@@ -52,6 +57,7 @@ dependencies = [
     "pymaster",
     "regions",
     "reproject",
+    "sacc>=0.12",
     # scipy 1.18 ported FITPACK from Fortran to C, changing the return shape of
     # RectBivariateSpline(scalar, scalar, grid=False) from 0-d `array(x)` to
     # shape-(1,) `array([x])`. camb's BBN Y_He predictor (bbn.py) wraps the
@@ -69,6 +75,12 @@ dependencies = [
     # getdist feature-branch below, which is an external fork we pin for repro.)
     "shear_psf_leakage @ git+https://github.com/CosmoStat/shear_psf_leakage.git@develop",
     "skyproj",
+    # UNIONS-WL fork of DESC Smokescreen, pinned by SHA on the fork's
+    # packaging branch: it declares pyccl and imports its theory backends
+    # lazily, so the install closure is CCL-only. Provisional pin — swapped to the
+    # fork's release tag once the fork packaging PRs merge. Git pin only;
+    # nothing is published to PyPI.
+    "smokescreen @ git+https://github.com/UNIONS-WL/Smokescreen@588a6b9b26560bd5ba3dd5ba342f3c40152644f9",
     "statsmodels",
     "treecorr>=5.0",
     "tqdm",
@@ -124,7 +136,7 @@ markers = [
 
 [tool.ruff]
 line-length = 88
-target-version = "py311"
+target-version = "py312"
 
 # Snakemake injects a `snakemake` object into rule scripts at runtime, so ruff
 # can't see where it's defined. Declaring it a builtin silences the false