diff --git a/services/data/requirements.txt b/services/data/requirements.txt
index 3d5aab0d..10593a43 100644
--- a/services/data/requirements.txt
+++ b/services/data/requirements.txt
@@ -10,6 +10,6 @@ networkx>=3.0         # trimesh path traversal (section drawings)
 shapely>=2.1.2          # trimesh planar paths
 reportlab>=4.0        # PDF sheet composition
 pillow>=12.3.0        # reportlab's image dep — floor over 8 CVEs in 12.2.x (PYSEC-2026-2253..3453)
-defusedxml>=0.7       # XXE-safe parser for untrusted P6 (PMXML) schedule uploads — schedule.py
+defusedxml>=0.7.1       # XXE-safe parser for untrusted P6 (PMXML) schedule uploads — schedule.py
 # svglib (SVG→PNG for docs gallery) is a dev-only tool — it pulls pycairo/cairo and is not
 # needed at runtime (the API serves SVG directly). Install ad hoc when regenerating docs/img.