diff --git a/apps/backend/requirements-dev.txt b/apps/backend/requirements-dev.txt
index c5909ef9..6b957955 100644
--- a/apps/backend/requirements-dev.txt
+++ b/apps/backend/requirements-dev.txt
@@ -1,5 +1,5 @@
 -r requirements.txt
-pytest==8.3.4
+pytest==9.0.3
 pytest-asyncio==0.24.0
 pytest-cov==6.0.0
 ruff==0.8.4
diff --git a/apps/backend/requirements.txt b/apps/backend/requirements.txt
index 32923346..d30157e3 100644
--- a/apps/backend/requirements.txt
+++ b/apps/backend/requirements.txt
@@ -97,7 +97,7 @@ aiosmtplib==3.0.2
 # render_report_pdf runs in the API endpoint api/v1/reports.py, not a Celery
 # task) and rendering a real PDF -- services.report_service.render_report_pdf
 # returns `b'%PDF'`. Re-verify the render on every future bump of either pin.
-weasyprint==68.0
+weasyprint==69.0
 pydyf==0.12.1
 
 # openpyxl — XLSX vulnerability-report export (Phase G, api/v1/reports.py