diff --git a/pyproject.toml b/pyproject.toml
index ed6a9d7f9..92d5e9c69 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -29,6 +29,8 @@ dbt-core = ">=1.8,<2.0.0"
 requests = ">=2.28.1,<3.0.0"
 urllib3 = ">=2.7.0,<3.0.0"
 idna = ">=3.15,<4"  # transitive dependency via requests, pinned to address CVE-2025-46816
+pyasn1 = ">=0.6.4,<0.7"  # transitive dependency via google-auth/pyasn1-modules, pinned to address BER/CER/DER decoder DoS advisories
+cryptography = ">=50.0.0,<51"  # transitive dependency via google-auth/azure-storage-blob, pinned to address CVE-2026-69247 (PKCS#7 Bleichenbacher oracle)
 beautifulsoup4 = "<5.0.0"
 ratelimit = "*"
 posthog = "<3.0.0"