diff --git a/pyproject.toml b/pyproject.toml
index 03dd26dd..231cd047 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -38,7 +38,7 @@ dependencies = [
     "authlib>=1.8.0",  # OIDC integration (Issue #200)
     # Security patches for transitive dependencies
     "jaraco-context>=6.1.2",  # GHSA-58pv-8j8x-9vj2 path traversal vulnerability
-    "wheel>=0.47.0",  # CVE-2026-24049 privilege escalation vulnerability
+    "wheel>=0.48.0",  # CVE-2026-24049 privilege escalation vulnerability
     "urllib3>=2.6.3",  # GHSA-38jv-5279-wg99, GHSA-2xpw-w6gg-jr37, GHSA-gm62-xv2j-4w53, GHSA-pq67-6m6q-mj2v
     "cryptography>=50.0.1",  # GHSA-537c-gmf6-5ccf vulnerable OpenSSL bundled in wheels (via authlib)
     "python-json-logger>=4.2.0",  # Structured JSON logging (Issue #208)
diff --git a/requirements.txt b/requirements.txt
index 08e408c2..0883da59 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -27,7 +27,7 @@ argon2-cffi>=25.1.0
 email-validator>=2.3.0
 authlib>=1.8.0
 jaraco-context>=6.1.2
-wheel>=0.47.0
+wheel>=0.48.0
 urllib3>=2.6.3
 cryptography>=50.0.1
 python-json-logger>=4.2.0