diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8973f22..c8f4afa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,6 +16,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - chore: add 403 forbidden response to endpoints
 - feat(jobs): add database_fork job type
 
+### Security
+
+- fix(deps): require urllib3 >=2.8.0 (GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g,
+  GHSA-vxq7-64xx-v4gw). Projects that pin urllib3 below 2.8.0 must raise that
+  pin to upgrade.
+
 ## [0.11.0] - 2026-09-18
 
 ### Removed
diff --git a/pyproject.toml b/pyproject.toml
index fa15d01..a13a67f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,7 @@ keywords = ["hotdata", "api-client", "data-platform"]
 requires-python = ">=3.10"
 
 dependencies = [
-  "urllib3 (>=2.7.0,<3.0.0)",
+  "urllib3 (>=2.8.0,<3.0.0)",
   "python-dateutil (>=2.8.2)",
   "pydantic (>=2.4.0)",
   "typing-extensions (>=4.7.1)",
diff --git a/requirements.txt b/requirements.txt
index 1cbcd4b..11b7417 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-urllib3 >= 2.7.0, < 3.0.0
+urllib3 >= 2.8.0, < 3.0.0
 python_dateutil >= 2.8.2
 pydantic >= 2.4.0
 typing-extensions >= 4.7.1
diff --git a/uv.lock b/uv.lock
index 49fd808..03d8a01 100644
--- a/uv.lock
+++ b/uv.lock
@@ -33,7 +33,7 @@ requires-dist = [
     { name = "pydantic", specifier = ">=2.4.0" },
     { name = "python-dateutil", specifier = ">=2.8.2" },
     { name = "typing-extensions", specifier = ">=4.7.1" },
-    { name = "urllib3", specifier = ">=2.7.0,<3.0.0" },
+    { name = "urllib3", specifier = ">=2.8.0,<3.0.0" },
 ]
 provides-extras = ["arrow"]
 
@@ -269,9 +269,9 @@ wheels = [
 
 [[package]]
 name = "urllib3"
-version = "2.7.0"
+version = "2.8.0"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e3/05/b17359e1cefb4f909b5e40b1b90a496d987258916dbbf88e842c729f510e/urllib3-2.8.0.tar.gz", hash = "sha256:63bf2ead4c879426ebf22ef2a781eeb4aa3b4ae798a0435506f8687fd5bb9b63", size = 458972, upload-time = "2026-09-15T19:29:36.253Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+    { url = "https://files.pythonhosted.org/packages/92/9d/c4e665119135114480843e7ab388fa94d8480650450e6f8e26b70d323a4c/urllib3-2.8.0-py3-none-any.whl", hash = "sha256:0cf3cae568d36aa9576b28dfb35f11328f1cb974ca7647d9475ebb86c75ac6e3", size = 135717, upload-time = "2026-09-15T19:29:34.577Z" },
 ]