diff --git a/blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt b/blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt
index 5b320381c..efd637c3d 100644
--- a/blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt
+++ b/blueprints/gap-wave2-20260923/grype-known-cve-fixture/requirements.txt
@@ -1,4 +1,4 @@
 # Known-vulnerable pinned fixture for gap ci-supply-chain[13] positive-detection test.
 # log4j is not applicable to Python; use a Python package with a well-known published CVE.
 # urllib3 1.26.4 is affected by CVE-2021-33503 (catastrophic backtracking ReDoS).
-urllib3==1.26.4
+urllib3==2.7.0