diff --git a/Cargo.lock b/Cargo.lock
index 326626c..595fa5a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -930,7 +930,7 @@ dependencies = [
  "rstest",
  "rusqlite",
  "secrecy",
- "security-framework 2.11.1",
+ "security-framework 3.7.0",
  "serde",
  "serde_json",
  "serde_yaml_ng",
diff --git a/crates/clx-core/Cargo.toml b/crates/clx-core/Cargo.toml
index c8437a0..2366068 100644
--- a/crates/clx-core/Cargo.toml
+++ b/crates/clx-core/Cargo.toml
@@ -64,7 +64,7 @@ fastembed = "5"
 # dependency tree, no duplicate Security.framework binding). macOS-gated so
 # non-macOS builds never pull these.
 [target.'cfg(target_os = "macos")'.dependencies]
-security-framework = "2.11"
+security-framework = "3.7"
 core-foundation = "0.9"
 
 # `bounded_read` opens untrusted-path files with O_NONBLOCK on Unix so the