diff --git a/CHANGES b/CHANGES
index d292e11..a070bfe 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,6 +6,10 @@
 _Notes on upcoming releases will be added here_
 <!-- END PLACEHOLDER - ADD NEW CHANGELOG ENTRIES BELOW THIS LINE -->
 
+### Dependencies
+
+**Minimum `fastmcp>=3.4.2`** (was `>=3.4.0`). Picks up fastmcp 3.4.1's explicit `starlette>=1.0.1` floor, so installs can no longer resolve to a Starlette version affected by CVE-2026-48710 — previously this was constrained only transitively through `mcp`. (#77)
+
 ### What's new
 
 **One-call command completion with {tooliconl}`run-command`**
diff --git a/pyproject.toml b/pyproject.toml
index b8afe6a..66ca24b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -41,7 +41,7 @@ include = [
 
 dependencies = [
   "libtmux>=0.58.0,<1.0",
-  "fastmcp>=3.4.0,<4.0.0",
+  "fastmcp>=3.4.2,<4.0.0",
 ]
 
 [project.urls]
diff --git a/uv.lock b/uv.lock
index e32e1b1..d09597b 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1242,7 +1242,7 @@ testing = [
 
 [package.metadata]
 requires-dist = [
-    { name = "fastmcp", specifier = ">=3.4.0,<4.0.0" },
+    { name = "fastmcp", specifier = ">=3.4.2,<4.0.0" },
     { name = "libtmux", specifier = ">=0.58.0,<1.0" },
 ]