diff --git a/changelog.rst b/changelog.rst
index 4df5d69dd..a8f276b75 100644
--- a/changelog.rst
+++ b/changelog.rst
@@ -27,6 +27,11 @@ Features:
 
 Bug fixes:
 ----------
+* Require ``sqlparse`` 0.6.0 or newer. Every 0.5.x release is affected by the
+  denial-of-service and string-escaping advisories fixed in 0.6.0
+  (CVE-2026-59893, CVE-2026-54284, CVE-2026-71491 and CVE-2026-59894), and the
+  ``>=0.3.0`` floor let an existing installation keep a vulnerable version
+  across a pgcli upgrade.
 * Fix special commands being broken while explain mode (F5) is on. Every input
   was prefixed with ``EXPLAIN (...)`` and sent to the server as SQL, including
   backslash commands and the bare words ``exit``/``quit``, so ``\q``, ``\d``,
diff --git a/pyproject.toml b/pyproject.toml
index 1f21e60ea..2de3ceb10 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -31,7 +31,7 @@ dependencies = [
     "prompt_toolkit>=2.0.6,<4.0.0",
     "psycopg >= 3.0.14; sys_platform != 'win32'",
     "psycopg-binary >= 3.0.14; sys_platform == 'win32'",
-    "sqlparse >=0.3.0,<0.7",
+    "sqlparse >=0.6.0,<0.7",
     "configobj >= 5.0.6",
     "cli_helpers[styles] >= 2.4.0",
     # setproctitle is used to mask the password when running `ps` in command line.