diff --git a/dev-tools/extract_model_ops/requirements.txt b/dev-tools/extract_model_ops/requirements.txt
index 0e49d0e491..898b08b110 100644
--- a/dev-tools/extract_model_ops/requirements.txt
+++ b/dev-tools/extract_model_ops/requirements.txt
@@ -6,5 +6,7 @@ torch==2.7.1
 # dev/CI-only tool. We additionally default trust_remote_code=False (see
 # torchscript_utils.load_and_trace_hf_model) to neutralise that class of issue.
 transformers>=4.40.0,<5.0.0
-sentencepiece>=0.2.0
+# 0.2.1 fixes CVE-2026-1260 (heap overflow parsing a malicious precompiled
+# normalization model).
+sentencepiece>=0.2.1
 protobuf>=5.0.0
diff --git a/dev-tools/test-requirements.txt b/dev-tools/test-requirements.txt
index 188fc9094b..c8f006b89f 100644
--- a/dev-tools/test-requirements.txt
+++ b/dev-tools/test-requirements.txt
@@ -3,3 +3,6 @@ pytest>=7.0.0,<9
 # Import-time deps for changelog scripts exercised by tests (bundle_changelogs, etc.).
 PyYAML>=6.0
 jsonschema>=4.0.0
+# Transitive dep (via jsonschema/importlib.metadata); floor-pinned to pull in the
+# fix for CVE-2024-5569 (infinite-loop DoS on malformed zip paths).
+zipp>=3.19.1