diff --git a/CHANGELOG.md b/CHANGELOG.md
index a627101..fec45a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,18 @@
 All notable changes to **basou** are recorded here. The project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html) starting with v0.1.0.
 
+## Unreleased
+
+### Changed
+
+- **`@basou/core` now depends on zod 4.6.7 or later, for an advisory against
+  the versions before 4.6.6.** GHSA-mrhx-c7xc-m3w5: zod before 4.6.6 can
+  exhaust memory while validating oversized constrained collections. The
+  declared range already admitted the fixed versions, so a fresh install of
+  `0.74.1` resolves to them; this release makes the declared floor say so.
+  No source changed, and the committed JSON Schema artifacts are
+  byte-identical when regenerated with zod 4.6.7.
+
 ## 0.74.1 — 2026-10-23
 
 ### Fixed
diff --git a/packages/core/package.json b/packages/core/package.json
index 2d22038..c878d9b 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -62,7 +62,7 @@
     "simple-git": "^4.0.2",
     "ulid": "^3.0.2",
     "yaml": "^2.9.1",
-    "zod": "^4.6.5"
+    "zod": "^4.6.7"
   },
   "devDependencies": {
     "ajv": "^8.17.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index ffdb32b..d605e2d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -57,8 +57,8 @@ importers:
         specifier: ^2.9.1
         version: 2.9.1
       zod:
-        specifier: ^4.6.5
-        version: 4.6.5
+        specifier: ^4.6.7
+        version: 4.6.7
     devDependencies:
       ajv:
         specifier: ^8.17.1
@@ -1097,8 +1097,8 @@ packages:
     engines: {node: '>= 14.6'}
     hasBin: true
 
-  zod@4.6.5:
-    resolution: {integrity: sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==}
+  zod@4.6.7:
+    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
 
 snapshots:
 
@@ -1887,4 +1887,4 @@ snapshots:
 
   yaml@2.9.1: {}
 
-  zod@4.6.5: {}
+  zod@4.6.7: {}