diff --git a/requirements-dev.txt b/requirements-dev.txt
index 5d428b7..85d05dd 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -3,7 +3,7 @@
 # The detector and OCR models are loaded lazily at runtime, so ultralytics,
 # torch and hezar are NOT needed to run the tests — which keeps CI to seconds.
 # Install requirements.txt as well if you want to exercise real inference.
-flask>=3.0,<4.0
+flask>=3.1.3,<4.0
 waitress>=3.0,<4.0
 numpy>=1.26
 pillow>=10.0
diff --git a/requirements.txt b/requirements.txt
index 1b8b3d4..b8a709e 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,6 +1,6 @@
 # Lower bounds are pinned so a fresh install cannot silently pick up an
 # incompatible major release. Loosen them if you need to.
-flask>=3.0,<4.0
+flask>=3.1.3,<4.0
 waitress>=3.0,<4.0        # production WSGI server (Flask's own is dev-only)
 ultralytics>=8.2,<9.0
 opencv-python>=4.8,<5.0