diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ffff1241..4181b497 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -39,7 +39,7 @@ jobs:
         with:
           python-version: '3.14'
       - name: Install pinned linters (keep in sync with pyproject [dev])
-        run: pip install ruff==0.15.13 black==26.3.1
+        run: pip install ruff==0.15.21 black==26.5.1
       - name: Ruff
         run: ruff check diff_diff tests
       - name: Black
@@ -60,7 +60,7 @@ jobs:
       # The package itself is NOT installed (mypy analyzes source directly;
       # no maturin/Rust build ever enters this workflow).
       - name: Install mypy + runtime deps for their type stubs (pinned)
-        run: pip install mypy==2.1.0 numpy==2.4.5 pandas==3.0.3 scipy==1.17.1
+        run: pip install mypy==2.3.0 numpy==2.4.5 pandas==3.0.3 scipy==1.17.1
       - name: Mypy
         run: mypy diff_diff
 
diff --git a/.github/workflows/rust-test.yml b/.github/workflows/rust-test.yml
index 1c82bbd4..bf2940b8 100644
--- a/.github/workflows/rust-test.yml
+++ b/.github/workflows/rust-test.yml
@@ -124,6 +124,12 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest, ubuntu-24.04-arm]
         python-version: ['3.11', '3.13', '3.14']
+        include:
+          # Python 3.9 floor guard (single Linux leg): mypy >= 2.2 can no
+          # longer type-check with python_version = "3.9", so this runtime
+          # leg is the floor's only continuous CI coverage.
+          - os: ubuntu-latest
+            python-version: '3.9'
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a9081ba5..7f53e2e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [Unreleased]
 
 ### Changed
+- **Internal: dev tooling pins bumped** (Dependabot group + manual lint.yml sync):
+  `black==26.5.1`, `ruff==0.15.21`, `mypy==2.3.0` in both the `dev` extra and the
+  Lint CI workflow. mypy >= 2.2 can no longer target Python 3.9, so
+  `[tool.mypy] python_version` moves to `"3.10"` (the library floor stays 3.9);
+  as a compensating floor guard the gated test matrix gains a dedicated
+  Python 3.9 Linux leg.
 - **CI + local AI PR-reviewer model upgraded `gpt-5.5` -> `gpt-5.6-sol` (effort stays
   `xhigh`).** Validated empirically before the swap via the `tools/reviewer-eval/`
   4-arm blinded campaign (66 runs over 11 cases; three independent identity-blind
diff --git a/TODO.md b/TODO.md
index 5392e281..c17fb9eb 100644
--- a/TODO.md
+++ b/TODO.md
@@ -243,8 +243,10 @@ IF/GMM estimators are tracked in
 ### Type Annotations
 
 `mypy diff_diff` is **enforced at zero errors** by the Lint CI workflow's Mypy job at the
-pinned `mypy==2.1.0` (ungated, every PR push; pins synced with the `dev` extra via
-`TestLintWorkflowPinSync`). Zero is reached with documented suppressions — tightening them
+pinned `mypy==2.3.0` (ungated, every PR push; pins synced with the `dev` extra via
+`TestLintWorkflowPinSync`). `[tool.mypy] python_version` targets `"3.10"` (mypy >= 2.2
+cannot target 3.9); the Python 3.9 library floor is covered by a dedicated runtime leg in
+the gated test matrix instead. Zero is reached with documented suppressions — tightening them
 is tracked in Actionable Backlog → Testing / docs:
 
 - Global `disable_error_code = ["arg-type", "return-value", "var-annotated", "assignment"]`
diff --git a/pyproject.toml b/pyproject.toml
index bd908d31..b08ee47b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -64,9 +64,9 @@ dev = [
     # Lint CI workflow (.github/workflows/lint.yml) — update both together.
     # NOTE: black/mypy require Python >= 3.10 (dev tooling only; the library
     # floor stays 3.9).
-    "black==26.3.1",
-    "ruff==0.15.13",
-    "mypy==2.1.0",
+    "black==26.5.1",
+    "ruff==0.15.21",
+    "mypy==2.3.0",
     "maturin>=1.4,<2.0",
     "matplotlib>=3.5",
     "nbmake>=1.5",
@@ -150,7 +150,11 @@ ignore = ["E501"]
 "tests/test_t19_marketing_pulse_drift.py" = ["E741"]
 
 [tool.mypy]
-python_version = "3.9"
+# mypy >= 2.2 cannot target Python 3.9 (python_version must be >= 3.10), so
+# static checking runs against 3.10 even though the library floor stays 3.9.
+# The floor is guarded at runtime instead: the gated test matrix carries a
+# dedicated Python 3.9 leg (.github/workflows/rust-test.yml).
+python_version = "3.10"
 warn_return_any = false
 warn_unused_configs = true
 ignore_missing_imports = true