diff --git a/pyproject.toml b/pyproject.toml
index 3908023..8ee8ba7 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ dependencies = [
     "act-sdk>=0.2.0",
     # Defense-in-depth pin; act-sdk also pins this. cbor2 6.0 is a Rust
     # C-extension that doesn't load inside componentize-py wasm.
-    "cbor2>=5.9.0,<6",
+    "cbor2>=5.9.0,<7",
 ]
 
 [dependency-groups]