diff --git a/README.md b/README.md
index b002fa1..072c76a 100644
--- a/README.md
+++ b/README.md
@@ -163,4 +163,4 @@ and its reasoning, and what is deferred.
 `docs/PROD_RUNBOOK.md` — production checklist: require `SIGIL_SEAL_PASS` and
 `SIGIL_ANCHOR` on separate storage, verify-chain alerts, integration sharp edges.
 
-`requirements.txt` — pinned `cryptography>=43.0.0,<45`.
+`requirements.txt` — `cryptography>=44.0.1,<45`; see `requirements.lock.txt` / `constraints.txt`.
diff --git a/constraints.txt b/constraints.txt
new file mode 100644
index 0000000..68d71ba
--- /dev/null
+++ b/constraints.txt
@@ -0,0 +1,3 @@
+# Exact pin matching requirements.lock.txt floor. Use with:
+#   pip install -r requirements.txt -c constraints.txt
+cryptography==44.0.1
diff --git a/docs/PROD_RUNBOOK.md b/docs/PROD_RUNBOOK.md
index 92b0a65..ea0b781 100644
--- a/docs/PROD_RUNBOOK.md
+++ b/docs/PROD_RUNBOOK.md
@@ -39,3 +39,8 @@ store the checkpoint signer's private key in the Sigil DB — public history onl
 - SQLCipher / page-level encryption for multi-tenant co-resident hosts.
 - Domain-separated challenge payloads (`sigil-challenge-v1` prefix) — backward-incompatible without a protocol version.
 - Shared cross-process rate limiter.
+
+## Dependencies
+
+Install with `pip install -r requirements.txt -c constraints.txt`
+(or `--require-hashes -r requirements.lock.txt`). Floor is `cryptography>=44.0.1`.
diff --git a/requirements.lock.txt b/requirements.lock.txt
new file mode 100644
index 0000000..7d598c9
--- /dev/null
+++ b/requirements.lock.txt
@@ -0,0 +1,13 @@
+# Hash-pinned lock for Sigil runtime crypto deps.
+# Install: pip install --require-hashes -r requirements.lock.txt
+# Floor cryptography==44.0.1 addresses CVE-2024-12797 in older wheels.
+
+cryptography==44.0.1 \
+    --hash=sha256:53f23339864b617a3dfc2b0ac8d5c432625c80014c25caac9082314e9de56f41
+
+cffi==2.1.1 \
+    --hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2
+
+pycparser==3.0 \
+    --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992
+
diff --git a/requirements.txt b/requirements.txt
index 79a50e0..0289de6 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,3 +1,5 @@
 # Runtime dependency for Ed25519 + AES-GCM (SealedStore / optional key files).
-# Pin a known-good lower bound; upper bound avoids surprise major breaks in CI.
-cryptography>=43.0.0,<45
+# Lower bound 44.0.1: older 43.x/44.0.0 wheels ship OpenSSL affected by
+# CVE-2024-12797 (GHSA-79v4-65xg-pq4g). Upper bound <45 keeps upgrades deliberate.
+# For hash-pinned install see requirements.lock.txt.
+cryptography>=44.0.1,<45