diff --git a/requirements.txt b/requirements.txt
index 283df129..a6890cc9 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -25,7 +25,7 @@ certifi==2024.2.2
     # via
     #   requests
     #   sentry-sdk
-cffi==1.16.0
+cffi==1.17.1
     # via cryptography
 charset-normalizer==3.3.2
     # via requests
@@ -106,6 +106,11 @@ sqlalchemy==1.2.19
     # via
     #   -r requirements.in
     #   sqltap
+setuptools==81.0.0
+    # via python-graph-core (pkg_resources namespace; implicit dep on Python 3.13)
+    # Pinned <82: setuptools 82 removed pkg_resources entirely; python-graph-core
+    # depends on it via namespace packages. Remove this pin once python-graph-core
+    # no longer uses pkg_resources (tracked in hatnote/montage#421).
 sqlparse==0.5.0
     # via sqltap
 sqltap==0.3.11