diff --git a/cli_bundle/requirements.txt b/cli_bundle/requirements.txt
index 2ac9385b..52e2359d 100644
--- a/cli_bundle/requirements.txt
+++ b/cli_bundle/requirements.txt
@@ -1,7 +1,7 @@
 # Core CLI/runtime deps (safe across Linux runners)
 click==8.3.0
 rich==14.1.0
-pyyaml==6.0.2
+pyyaml==6.0.3
 requests==2.32.5  # fixed .netrc credential leak (CVE-2024-35195)
 pandas==2.3.2
 numpy==2.2.6
diff --git a/docker/requirements.txt b/docker/requirements.txt
index 2c6a3757..0722a5b6 100644
--- a/docker/requirements.txt
+++ b/docker/requirements.txt
@@ -1,7 +1,7 @@
 # Core CLI/runtime deps (safe across Linux runners)
 click==8.3.0
 rich==14.1.0
-pyyaml==6.0.2
+pyyaml==6.0.3
 requests==2.32.5  # fixed .netrc credential leak (CVE-2024-35195)
 pandas==2.3.2
 numpy==2.2.6