diff --git a/pyproject.toml b/pyproject.toml
index 4ecdfea..0e02fc6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -42,7 +42,7 @@ dependencies = [
     # — a big jump from the tested baseline. These are the versions QueryHub
     # is verified against; widen the cap deliberately after testing a newer
     # FastAPI/Starlette, not implicitly on every fresh install.
-    "fastapi>=0.115.0,<0.140",
+    "fastapi>=0.115.0,<0.141",
     "uvicorn[standard]>=0.30.0,<0.52",
     "PyJWT[crypto]>=2.9.0",
     "httpx>=0.27.0",
@@ -63,7 +63,7 @@ dev = [
     # style choices, which would break CI on every push. Keep the linter
     # deterministic here; adopting 0.16's rules is a separate, deliberate
     # cleanup.
-    "ruff>=0.6,<0.16",
+    "ruff>=0.6,<0.17",
     "mypy>=1.10",
 ]
 # Slack transport (the /sql bot + Slack approval/notification/delivery
diff --git a/requirements.txt b/requirements.txt
index 7807154..d18d8a3 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -14,7 +14,7 @@ openpyxl>=3.1.0
 # pulled a FastAPI/Starlette generation past the tested baseline while
 # pyproject deliberately capped it, so the two install paths disagreed and
 # the documented upgrade flow used the uncapped one. Widen both together.
-fastapi>=0.115.0,<0.140
+fastapi>=0.115.0,<0.141
 uvicorn[standard]>=0.30.0,<0.52
 PyJWT[crypto]>=2.9.0
 httpx>=0.27.0