diff --git a/constraints/dev.txt b/constraints/dev.txt
index 0d75ee4d..cbb10ee5 100644
--- a/constraints/dev.txt
+++ b/constraints/dev.txt
@@ -38,7 +38,7 @@
 # Compared against the source by scripts/verify_dependency_lock.py, so a
 # changed extra, marker, URL or range cannot slip past without recompiling.
 #
-#   declares: build<2,>=1.5.0
+#   declares: build<2,>=1.6.0
 #   declares: cryptography<51,>=50.0.1
 #   declares: cyclonedx-bom<8,>=7.3.1
 #   declares: hypothesis<7,>=6.165.10
diff --git a/constraints/release-seal.in b/constraints/release-seal.in
index 25a22521..96c14d2d 100644
--- a/constraints/release-seal.in
+++ b/constraints/release-seal.in
@@ -1,3 +1,3 @@
-build==1.5.0
+build==1.6.0
 hatchling==1.32.0
 sigstore==4.5.0
diff --git a/constraints/release-seal.txt b/constraints/release-seal.txt
index 0bd6c3dc..ac306c56 100644
--- a/constraints/release-seal.txt
+++ b/constraints/release-seal.txt
@@ -40,7 +40,7 @@
 # Compared against the source by scripts/verify_dependency_lock.py, so a
 # changed extra, marker, URL or range cannot slip past without recompiling.
 #
-#   declares: build==1.5.0
+#   declares: build==1.6.0
 #   declares: hatchling==1.32.0
 #   declares: sigstore==4.5.0
 #
@@ -48,9 +48,9 @@ annotated-types==0.8.0 \
     --hash=sha256:13b2beaad985e05e2d6407ee4c4f35590b11f8d693a258a561055cac8f64cab7 \
     --hash=sha256:f072f4d804ea359e4eaf198b1af7a8b0943881a87f31bb764f8bf219bb9419e0
     # via pydantic
-build==1.5.0 \
-    --hash=sha256:13f3eecb844759ab66efec90ca17639bbf14dc06cb2fdf37a9010322d9c50a6f \
-    --hash=sha256:302c22c3ba2a0fd5f3911918651341ebb3896176cbdec15bd421f80b1afc7647
+build==1.6.0 \
+    --hash=sha256:bd2c8afc603e7a2e0ce70e2ea85f0a6d02043bafbd307f5bada0f98669eca5af \
+    --hash=sha256:f7aaf1ebbb79178a02ba248bb524f2176b256017e17e8e4bd4289c7b38cc2bad
     # via -r constraints/release-seal.in
 certifi==2026.7.22 \
     --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \
@@ -615,9 +615,9 @@ rich==15.0.0 \
     --hash=sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb \
     --hash=sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36
     # via sigstore
-securesystemslib==1.5.0 \
-    --hash=sha256:3701219c8149a0b1b45f4298d672efc78cd15c0d7d83d5a18bf585e1fce1320d \
-    --hash=sha256:66d2ea40ae150fb938767935a67252f5cfe37ec7cc2ec6e1d28c2509377014f6
+securesystemslib==1.5.1 \
+    --hash=sha256:4b8d00abd93707ead10b69eb2b8582376a1364de3b0a71077de534c2ef4985e0 \
+    --hash=sha256:ada8bdf817da29ece4ba91654f6a162ce7cfbadbc3ae3f840f7313f9d22675de
     # via tuf
 sigstore==4.5.0 \
     --hash=sha256:020d3e07f622b2916bf453e66ff6ff0711e1fdc5ab69e8bd8902f71d9fcb316f \
diff --git a/pyproject.toml b/pyproject.toml
index 751853d3..812cfe1f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -91,7 +91,7 @@ mcp = [
   "mcp>=2.1.1,<3",
 ]
 dev = [
-  "build>=1.5.0,<2",
+  "build>=1.6.0,<2",
   "cyclonedx-bom>=7.3.1,<8",
   "hypothesis>=6.165.10,<7",
   "jsonschema>=4.26.0,<5",