diff --git a/CHANGELOG.md b/CHANGELOG.md
index caaf5e60..e706403d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
+- Raise the A2A SDK and development extras' `pyasn1` security floor to 0.6.5,
+  alongside the development/CI hash lock, clearing four dependency-audit
+  findings for 0.6.4.
+
 - Sealing to a low-order X25519 peer key raises `SealedChannelError`, consistent
   with other invalid channel keys, instead of leaking a backend `ValueError`.
   These keys were already refused; no ciphertext format or acceptance rule changes.
diff --git a/pyproject.toml b/pyproject.toml
index 4cf4691a..f6515ffe 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -49,6 +49,7 @@ tpm = [
 a2a-sdk = [
     "a2a-sdk>=1.1,<2",
     "aiohttp>=3.14.3",
+    "pyasn1>=0.6.5",
 ]
 dev = [
     "pytest>=8.0",
@@ -66,6 +67,7 @@ dev = [
     "a2a-sdk[http-server]==1.2.2",
     "uvicorn==0.54.0",
     "aiohttp>=3.14.3",
+    "pyasn1>=0.6.5",
 ]
 
 [project.scripts]
diff --git a/requirements/dev.in b/requirements/dev.in
index ad636eff..36a848d0 100644
--- a/requirements/dev.in
+++ b/requirements/dev.in
@@ -25,3 +25,6 @@ a2a-sdk[http-server]==1.2.2
 uvicorn==0.54.0
 aiohttp>=3.14.3
 setuptools>=83.0.0
+
+# Security floor for google-auth's transitive ASN.1 dependency (four audit findings).
+pyasn1>=0.6.5
diff --git a/requirements/dev.txt b/requirements/dev.txt
index a57d254f..981e67dc 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -1710,10 +1710,12 @@ py-serializable==2.1.0 \
     --hash=sha256:9d5db56154a867a9b897c0163b33a793c804c80cee984116d02d49e4578fc103 \
     --hash=sha256:b56d5d686b5a03ba4f4db5e769dc32336e142fc3bd4d68a8c25579ebb0a67304
     # via cyclonedx-python-lib
-pyasn1==0.6.4 \
-    --hash=sha256:9c447d8431c947fe4c8febc4ed9e760bc29011a5b01e5c74b67025bd9fb8ce81 \
-    --hash=sha256:deda9277cfd454080ec40b207fb6df82206a3a2688735233cdcd8d3d565f088b
-    # via pyasn1-modules
+pyasn1==0.6.5 \
+    --hash=sha256:4017b0fce125096b8573b39c989fdb1a4b19cf761e683398184550fea0e66587 \
+    --hash=sha256:6b11616a6bcf3a40e635f082bb232fa57b5e0dd7f517bd7ddd69ec3794508a47
+    # via
+    #   -r requirements/dev.in
+    #   pyasn1-modules
 pyasn1-modules==0.4.2 \
     --hash=sha256:29253a9207ce32b64c3ac6600edc75368f98473906e8fd1043bd6b5b1de2c14a \
     --hash=sha256:677091de870a80aae844b1ca6134f54652fa2c8c5a52aa396440ac3106e941e6