diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bf3b044..b3e29fd 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -85,6 +85,7 @@ jobs:
     - name: Install package and security tools
       run: |
         python -m pip install --upgrade pip
+        pip install --upgrade "setuptools>=83.0.0"  # PYSEC-2026-3447
         pip install -e ".[dev]"
         pip install bandit[toml] pip-audit