diff --git a/requirements-dev.txt b/requirements-dev.txt
index fdf614f..c66647c 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -2,7 +2,7 @@ flake8>=7.3.0
 bandit[toml]>=1.9.4
 pytest>=9.1.1
 pytest-cov>=7.1.0
-PyYAML>=6.0
+PyYAML>=6.0.3
 
 # starlette's TestClient (used by tests/test_api.py) requires httpx2;
 # it falls back to httpx with a deprecation warning, and raises if neither