diff --git a/requirements-ci-py310.txt b/requirements-ci-py310.txt
index 58a0e5a..669d069 100644
--- a/requirements-ci-py310.txt
+++ b/requirements-ci-py310.txt
@@ -460,9 +460,9 @@ pyparsing==3.3.2 \
     --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
     --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
     # via pip-requirements-parser
-pytest==9.0.2 \
-    --hash=sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b \
-    --hash=sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11
+pytest==9.0.3 \
+    --hash=sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9 \
+    --hash=sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c
     # via -r requirements-ci.in
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
diff --git a/requirements-ci.in b/requirements-ci.in
index 22280e5..a739ba2 100644
--- a/requirements-ci.in
+++ b/requirements-ci.in
@@ -9,7 +9,7 @@ cryptography==46.0.7
 prometheus-client>=0.20.0,<1.0.0
 opentelemetry-api>=1.24.0,<2.0.0
 opentelemetry-sdk>=1.24.0,<2.0.0
-pytest>=7.4.0,<10.0.0
+pytest>=9.0.3,<10.0.0
 cyclonedx-bom<8
 # Python 3.10 compatibility shims required by pytest/cyclonedx transitive markers.
 exceptiongroup>=1.2.2,<2.0.0; python_version < "3.11"
diff --git a/requirements-ci.txt b/requirements-ci.txt
index 49067f1..fd440bc 100644
--- a/requirements-ci.txt
+++ b/requirements-ci.txt
@@ -517,9 +517,9 @@ pyparsing==3.3.2 \
     --hash=sha256:850ba148bd908d7e2411587e247a1e4f0327839c40e2e5e6d05a007ecc69911d \
     --hash=sha256:c777f4d763f140633dcb6d8a3eda953bf7a214dc4eff598413c070bcdc117cbc
     # via pip-requirements-parser
-pytest==9.0.2 \
-    --hash=sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b \
-    --hash=sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11
+pytest==9.0.3 \
+    --hash=sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9 \
+    --hash=sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c
     # via -r requirements-ci.in
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \