diff --git a/requirements-graph.in b/requirements-graph.in
index 3e39b0f..4c70026 100644
--- a/requirements-graph.in
+++ b/requirements-graph.in
@@ -1,2 +1,2 @@
 # Build-only dependency for the published repository code graph.
-graphifyy==0.9.51
+graphifyy==0.9.53
diff --git a/requirements-graph.txt b/requirements-graph.txt
index 19f74a4..e701f13 100644
--- a/requirements-graph.txt
+++ b/requirements-graph.txt
@@ -1,7 +1,7 @@
 --require-hashes
-graphifyy==0.9.51 \
-    --hash=sha256:10d32c5569576b15125f5cf94f277f511151bdf57369ae2636c88e08b2bf0519 \
-    --hash=sha256:70ec496e87d6d90e872dd850ed74f52a64e4f36c19011ce3844ea2f3036ac545
+graphifyy==0.9.53 \
+    --hash=sha256:900348aa7c41ef31c0581a8c2e0ca9f0b6a81f1e5bc6ef2184cce697e5342e3f \
+    --hash=sha256:c951490a2c8856fe46ade3c165780de501a3fe8de1c9414e971c378e8f4d2164
     # via -r requirements-graph.in
 networkx==3.6.1 \
     --hash=sha256:26b7c357accc0c8cde558ad486283728b65b6a95d85ee1cd66bafab4c8168509 \
diff --git a/requirements-test.txt b/requirements-test.txt
index 35b1646..c8e8a9f 100644
--- a/requirements-test.txt
+++ b/requirements-test.txt
@@ -3,9 +3,9 @@ async-timeout==5.0.1 ; python_full_version < '3.11.3' \
     --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \
     --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3
     # via redis
-authlib==1.7.2 \
-    --hash=sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231 \
-    --hash=sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f
+authlib==1.8.0 \
+    --hash=sha256:88aebbd9af6757e14e912d5dc007ae1dc1f3e27e3b2152ce7c552ee2c3b3c121 \
+    --hash=sha256:f3ecd5f1da737262fb53bf1a4d95c4ea1ad9dd509316587a255c99ab1838a4f0
     # via -r requirements.in
 bcrypt==5.0.0 \
     --hash=sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4 \
diff --git a/requirements.in b/requirements.in
index 6509a8d..0b46d0a 100644
--- a/requirements.in
+++ b/requirements.in
@@ -28,8 +28,8 @@ webauthn>=3.0,<4
 PyOTP>=2.10,<3
 # Compatibility: qrcode 8.2 provides local SVG QR generation without Pillow.
 qrcode>=8.2,<9
-# Compatibility: Authlib 1.7 is qualified for OIDC discovery, PKCE, state, nonce, and token validation.
-Authlib>=1.7,<2
+# Compatibility: Authlib 1.8 is qualified for OIDC discovery, PKCE, state, nonce, and token validation.
+Authlib>=1.8.0,<2
 # Compatibility: Authlib's Flask client uses the reviewed Requests 2.x transport API.
 requests>=2.34,<3
 # Compatibility: Bonsai 1.5.5 supports Python 3.10-3.14 and exposes the
diff --git a/requirements.txt b/requirements.txt
index 3d6088c..138aa29 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -3,9 +3,9 @@ async-timeout==5.0.1 ; python_full_version < '3.11.3' \
     --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \
     --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3
     # via redis
-authlib==1.7.2 \
-    --hash=sha256:2cea25fefcd4e7173bdf1372c0afc265c8034b23a8cd5dcb6a9164b826c64231 \
-    --hash=sha256:3e1faedc9d87e7d56a164eca3ccb6ace0d61b94abe83e92242f8dc8bba9b4a9f
+authlib==1.8.0 \
+    --hash=sha256:88aebbd9af6757e14e912d5dc007ae1dc1f3e27e3b2152ce7c552ee2c3b3c121 \
+    --hash=sha256:f3ecd5f1da737262fb53bf1a4d95c4ea1ad9dd509316587a255c99ab1838a4f0
     # via -r requirements.in
 bcrypt==5.0.0 \
     --hash=sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4 \
diff --git a/tests/test_dependency_policy.py b/tests/test_dependency_policy.py
index 748af8c..9823181 100644
--- a/tests/test_dependency_policy.py
+++ b/tests/test_dependency_policy.py
@@ -274,9 +274,9 @@ def test_graph_dependencies_are_hash_locked_and_generated_with_other_locks():
         encoding='utf-8'
     )
 
-    assert 'graphifyy==0.9.51' in graph_input
+    assert 'graphifyy==0.9.53' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.51' in graph_lock
+    assert 'graphifyy==0.9.53' in graph_lock
     assert 'requirements-graph.in' in lock_script
     assert 'requirements-graph.txt' in lock_script
 
diff --git a/tests/test_supply_chain_policy.py b/tests/test_supply_chain_policy.py
index 3811bce..ed69890 100644
--- a/tests/test_supply_chain_policy.py
+++ b/tests/test_supply_chain_policy.py
@@ -464,9 +464,9 @@ def test_graph_pages_toolchain_versions_are_explicit():
 
     assert re.search(r'with:\s*\n\s+version:\s*[\'"]?0\.12\.3', workflow)
     assert 'uv pip install --require-hashes -r requirements-graph.txt' in workflow
-    assert 'graphifyy==0.9.51' in graph_input
+    assert 'graphifyy==0.9.53' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.51' in graph_lock
+    assert 'graphifyy==0.9.53' in graph_lock
 
 
 def test_workflows_use_an_explicit_runner_release():