diff --git a/pyproject.toml b/pyproject.toml
index 20ceed2..9a45dbb 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -54,22 +54,22 @@ dependencies = [
     "pydantic>=2.13,<2.14",  # upper cap: pin to stable 2.13.x (excludes 2.14.0b2 beta; bump on 2.14.0 final)
     "aioconsole>=0.8.2",
     "pyfiglet>=1.0.4",
     "rcssmin>=1.2.2",
     "rjsmin>=1.2.5",
     "secure>=1.0.1,<3",  # upper cap: prevent next-major jumps
     "starception>=1.3.0",
     "starlette>=1.7.0,<2",  # upper cap: prevent major jumps
     "starlette-async-jinja>=1.15.0",
     "starlette-csrf>=3.0.0,<4",  # upper cap: prevent major jumps
-    "typer>=0.27.2",
-    "uvicorn>=0.54.0",
+    "typer>=0.27.2,<1",  # upper cap: prevent major jumps
+    "uvicorn>=0.54.0,<1",  # upper cap: prevent major jumps
 ]
 
 [project.license]
 text = "BSD-3-CLAUSE"
 
 [dependency-groups]
 # dev = project-agnostic developer tools (install with `uv sync --group dev`).
 # admin/monitoring/images = optional feature groups (install with
 # `uv sync --group admin` etc.). `cache` group removed in phase 3.2 (acb
 # extra deleted; no production consumers).
@@ -97,21 +97,21 @@ admin = [
 ]
 monitoring = [
     "logfire[starlette]>=4.41.0,<5",  # upper cap: prevents resolver picking logfire 6.0.0b*
 ]
 observability = [
     "prometheus-client>=0.26.0",
     "opentelemetry-sdk>=1.44.0",
     "opentelemetry-exporter-otlp-proto-http>=1.44.0",
     "sentry-sdk[opentelemetry]>=3.0.0a7,<3.0.0a8",  # Δ55 alpha-locked
     "mcp-common>=0.30.2,<0.31",  # Δ47 — <0.4 cap removed (prevents resolution against 0.24.x ecosystem as of 2026-08-31)
-    "structlog>=26.1.0",  # Δ40 — log_correlation mapping; matches oneiric>=0.13.4 strict dep (was ~=24.4)
+    "structlog>=26.1.0,<27",  # Δ40 — log_correlation mapping; matches oneiric>=0.13.4 strict dep (was ~=24.4); upper cap: prevent breaking changes
 ]
 images = [
     "cloudinary>=1.46.2",
     "imagekitio>=4.2.0",
 ]
 
 [tool.fastblocks-mcp]
 http_port = 3035
 http_host = "127.0.0.1"
 enable_http_transport = true
