diff --git a/src/Jellyfin.Plugin.TwoFactorAuth/Jellyfin.Plugin.TwoFactorAuth.csproj b/src/Jellyfin.Plugin.TwoFactorAuth/Jellyfin.Plugin.TwoFactorAuth.csproj
index 381d62e..a46b920 100644
--- a/src/Jellyfin.Plugin.TwoFactorAuth/Jellyfin.Plugin.TwoFactorAuth.csproj
+++ b/src/Jellyfin.Plugin.TwoFactorAuth/Jellyfin.Plugin.TwoFactorAuth.csproj
@@ -45,7 +45,7 @@
     <!-- Pinned: QuestPDF 2026.6.0 produced an invalid recovery-codes PDF
          ("Failed to load PDF document"); 2026.5.0 renders correctly. Do not
          auto-bump (Dependabot #77 closed for this). -->
-    <PackageReference Include="QuestPDF" Version="2026.5.0" />
+    <PackageReference Include="QuestPDF" Version="2026.7.2" />
     <PackageReference Include="IdentityModel.OidcClient" Version="6.0.0" />
     <!-- [v2.5.10] Reverted Dependabot #62's bump (8.18.0 -> 8.19.1). 8.19.1
          broke OIDC id_token signature validation (IDX10511: "Signature
diff --git a/src/Jellyfin.Plugin.TwoFactorAuth/packages.lock.json b/src/Jellyfin.Plugin.TwoFactorAuth/packages.lock.json
index e019be6..65df5d7 100644
--- a/src/Jellyfin.Plugin.TwoFactorAuth/packages.lock.json
+++ b/src/Jellyfin.Plugin.TwoFactorAuth/packages.lock.json
@@ -103,9 +103,9 @@
       },
       "QuestPDF": {
         "type": "Direct",
-        "requested": "[2026.5.0, )",
-        "resolved": "2026.5.0",
-        "contentHash": "QddELSgpJ7YFrNaqlqUik/OOhK2/yVDqdqGjtdH+V3nxml2cvjUorFp2yiK8xnTLLvR139SXpVt3G/0oVCynig=="
+        "requested": "[2026.7.2, )",
+        "resolved": "2026.7.2",
+        "contentHash": "GSPOoErqB4Yh7mnbV4m/ykHOF6erHdm5qyMRHDr4sjk+fvrtkEL+RoG5YpOqiWrS833jEiktC1Uthyy5/QMNQA=="
       },
       "System.IdentityModel.Tokens.Jwt": {
         "type": "Direct",