diff --git a/constraints-test.txt b/constraints-test.txt
index 7729e37..f3ae18c 100644
--- a/constraints-test.txt
+++ b/constraints-test.txt
@@ -11,46 +11,47 @@
 #   scripts\bootstrap_test_env.ps1 -Force -Relock         (Windows)
 # and commit the diff -- that diff is the dependency-change review surface.
 #
-# Generated against CPython 3.14 / macOS arm64. Version-only pins (no
-# hashes): they resolve wherever wheels are published for these versions;
-# an older interpreter or unusual ABI may need a source build or a re-lock
-# (--relock). Pins guard versions, not artifacts.
+# Version-only pins (no hashes): they resolve wherever wheels are published
+# for these versions; an older interpreter or unusual ABI may need a source
+# build or a re-lock (--relock). Pins guard versions, not artifacts.
 aiohappyeyeballs==2.6.2
-aiohttp==3.14.0
+aiohttp==3.14.1
 aiosignal==1.4.0
 attrs==26.1.0
 boolean.py==5.0
 CacheControl==0.14.4
-certifi==2026.5.20
+certifi==2026.6.17
 charset-normalizer==3.4.7
-cyclonedx-python-lib==11.8.0
+colorama==0.4.6
+cyclonedx-python-lib==11.11.0
 defusedxml==0.7.1
-filelock==3.29.1
+filelock==3.29.4
 frozenlist==1.8.0
 idna==3.18
 iniconfig==2.3.0
 license-expression==30.4.4
 markdown-it-py==4.2.0
 mdurl==0.1.2
-msgpack==1.1.2
+msgpack==1.2.0
 multidict==6.7.1
 packageurl-python==0.17.6
 packaging==26.2
 pillow==12.2.0
 pip-api==0.0.34
 pip-requirements-parser==32.0.1
-pip_audit==2.10.0
+pip_audit==2.10.1
 platformdirs==4.10.0
 pluggy==1.6.0
 propcache==0.5.2
 py-serializable==2.1.0
 Pygments==2.20.0
 pyparsing==3.3.2
-pytest==9.0.3
+pytest==9.1.0
 requests==2.34.2
 rich==15.0.0
 sortedcontainers==2.4.0
 tomli==2.4.1
 tomli_w==1.2.0
+typing_extensions==4.15.0
 urllib3==2.7.0
 yarl==1.24.2
diff --git a/scripts/bootstrap_test_env.ps1 b/scripts/bootstrap_test_env.ps1
index 85c0965..05bbfea 100644
--- a/scripts/bootstrap_test_env.ps1
+++ b/scripts/bootstrap_test_env.ps1
@@ -34,8 +34,11 @@ if (Test-Path .venv) {
 Write-Host "Creating .venv ..."
 python -m venv .venv
 
-Write-Host "Upgrading pip ..."
-.\.venv\Scripts\python -m pip install --quiet --upgrade pip
+Write-Host "Upgrading pip + setuptools ..."
+# setuptools is seeded into the venv by ensurepip (often an old, CVE-flagged
+# version) and is NOT captured in the lock (pip freeze skips it), so upgrade it
+# here or pip-audit fails every fresh bootstrap.
+.\.venv\Scripts\python -m pip install --quiet --upgrade pip setuptools
 
 if ((Test-Path $Constraints) -and (-not $Relock)) {
     Write-Host "Installing project + test extras (locked via $Constraints) ..."
diff --git a/scripts/bootstrap_test_env.sh b/scripts/bootstrap_test_env.sh
index b30f76a..173f59c 100755
--- a/scripts/bootstrap_test_env.sh
+++ b/scripts/bootstrap_test_env.sh
@@ -56,8 +56,11 @@ fi
 echo "Creating .venv ..."
 "$PYTHON_BIN" -m venv .venv
 
-echo "Upgrading pip ..."
-.venv/bin/python -m pip install --quiet --upgrade pip
+echo "Upgrading pip + setuptools ..."
+# setuptools is seeded into the venv by ensurepip (often an old, CVE-flagged
+# version) and is NOT captured in the lock (pip freeze skips it), so upgrade it
+# here or pip-audit fails every fresh bootstrap.
+.venv/bin/python -m pip install --quiet --upgrade pip setuptools
 
 if [ -f "$CONSTRAINTS" ] && [ -z "$RELOCK" ]; then
     echo "Installing project + test extras (locked via $CONSTRAINTS) ..."