diff --git a/sample-app/requirements.txt b/sample-app/requirements.txt
index 0653322..4c58f08 100644
--- a/sample-app/requirements.txt
+++ b/sample-app/requirements.txt
@@ -3,5 +3,5 @@
 # These pull in their own transitive deps (werkzeug, jinja2, markupsafe, click, blinker,
 # itsdangerous, packaging, ...) so the SBOM / SCA gates have a real, non-trivial component graph.
 Flask==3.0.3
-gunicorn==23.0.0
+gunicorn==26.0.0
 PyYAML==6.0.2