diff --git a/pyproject.toml b/pyproject.toml
index 3a58d76..0084805 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -56,7 +56,7 @@ dev = [
     # oracle we never touch), and pip is build tooling (PYSEC-2026-3721
     # needs a malicious package index).
     "cryptography>=50.0.0",
-    "pip>=26.2",
+    "pip>=26.2.2",
     # Both arrive under pip-audit itself via cachecontrol[filecache].
     # filelock 4.2.1 fixes nine local lock-file advisories (CVE-2026-112907
     # to 112940, symlink and Windows ACL cases); msgpack 1.2.3 fixes a C
diff --git a/uv.lock b/uv.lock
index 4095c89..c3cb7b8 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,5 +1,5 @@
 version = 1
-revision = 3
+revision = 5
 requires-python = ">=3.11"
 resolution-markers = [
     "python_full_version >= '3.15'",
@@ -1436,11 +1436,11 @@ wheels = [
 
 [[package]]
 name = "pip"
-version = "26.2.1"
+version = "26.2.2"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/ae/15/4500e320e6b101ec3b719ae85b697d9940b6cda672bc555bd6016fc60c6f/pip-26.2.1.tar.gz", hash = "sha256:f6ad667e89a1fe78046c8f13232b247200f5258d7828f3f7883d660878e0813f", size = 1848877, upload-time = "2026-08-04T22:51:14.148Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/fa/e8/0842d757e483e895e670f655084cfe8b8c72580c6769a76b30b2789a0608/pip-26.2.2.tar.gz", hash = "sha256:3a8e5c800492787f33a4114ef54444546c340df428974ebba17e0fd47e11af2f", size = 1863336, upload-time = "2026-10-20T16:36:29.008Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/f3/6e/1736e5b4ae2b778ef2f81c47d797de9f891d4d8acb047a24ca37a60294dd/pip-26.2.1-py3-none-any.whl", hash = "sha256:71138adf1f4ca900cdb7d289c21b7494329f2332b6d85f0e1c42108c0384ed3e", size = 1816632, upload-time = "2026-08-04T22:51:12.472Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/06/3e4420302363fbb71be3c7f35ce042f54bfca330e3e66b3a2e3c4cca579f/pip-26.2.2-py3-none-any.whl", hash = "sha256:fd7f4dfa8190e014013b9f08f3e973f4e4c26ffd179a204895533a7254813a70", size = 1819850, upload-time = "2026-10-20T16:36:27.046Z" },
 ]
 
 [[package]]
@@ -2203,7 +2203,7 @@ requires-dist = [
     { name = "mypy", marker = "extra == 'dev'", specifier = ">=1.20" },
     { name = "openai", marker = "extra == 'ai'", specifier = ">=2.0.0,<3.0.0" },
     { name = "openai", marker = "extra == 'dev'", specifier = ">=2.0.0,<3.0.0" },
-    { name = "pip", marker = "extra == 'dev'", specifier = ">=26.2" },
+    { name = "pip", marker = "extra == 'dev'", specifier = ">=26.2.2" },
     { name = "pip-audit", marker = "extra == 'dev'", specifier = ">=2.7" },
     { name = "psutil", specifier = ">=6.1.0,<8.0.0" },
     { name = "pydantic", specifier = ">=2.0,<3.0" },