diff --git a/pyproject.toml b/pyproject.toml
index d87ed654..5f48cc38 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,7 +41,7 @@ dependencies = [
     "pyjwt>=2.13.0",
     # python-engineio <= 4.13.1 / python-socketio <= 5.16.1 carry
     # Socket.IO CVEs. Both are transitive via flask-socketio; pin floors.
-    "python-engineio>=4.13.2",
+    "python-engineio>=4.13.4",
     "python-socketio>=5.16.2",
     # GHSA-qccp-gfcp-xxvc + GHSA-mf9v-mfxr-j63j — urllib3 < 2.7.0 leaks
     # sensitive headers across proxied redirects and bypasses the
diff --git a/requirements.txt b/requirements.txt
index 77f32c44..d50799fd 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -157,7 +157,7 @@ python-dotenv==1.2.2
     # via
     #   mlflow-skinny
     #   pydantic-settings
-python-engineio==4.13.3
+python-engineio==4.13.4
     # via
     #   coda (pyproject.toml)
     #   python-socketio