diff --git a/services/data/requirements.txt b/services/data/requirements.txt
index d7aa56e7..c50aff0d 100644
--- a/services/data/requirements.txt
+++ b/services/data/requirements.txt
@@ -8,7 +8,7 @@ manifold3d>=2.0       # boolean intersection engine for trimesh
 scipy>=1.11           # trimesh path assembly (section drawings)
 networkx>=3.0         # trimesh path traversal (section drawings)
 shapely>=2.0          # trimesh planar paths
-reportlab>=4.0        # PDF sheet composition
+reportlab>=5.0.0        # PDF sheet composition
 pillow>=12.3.0        # reportlab's image dep — floor over 8 CVEs in 12.2.x (PYSEC-2026-2253..3453)
 defusedxml>=0.7       # XXE-safe parser for untrusted P6 (PMXML) schedule uploads — schedule.py
 # svglib (SVG→PNG for docs gallery) is a dev-only tool — it pulls pycairo/cairo and is not