diff --git a/.sampo/changesets/heroic-queen-marjatta.md b/.sampo/changesets/heroic-queen-marjatta.md
new file mode 100644
index 0000000..53cf7e8
--- /dev/null
+++ b/.sampo/changesets/heroic-queen-marjatta.md
@@ -0,0 +1,5 @@
+---
+hex/posthog: patch
+---
+
+Require Req 0.6.1 or newer to avoid vulnerable 0.5.x and 0.6.0 releases.
diff --git a/mix.exs b/mix.exs
index fe5c6d4..249bf8a 100644
--- a/mix.exs
+++ b/mix.exs
@@ -65,7 +65,7 @@ defmodule PostHog.MixProject do
   defp deps do
     [
       {:nimble_options, "~> 1.1"},
-      {:req, "~> 0.5"},
+      {:req, ">= 0.6.1 and < 1.0.0"},
       {:logger_json, "~> 7.0"},
       {:nimble_ownership, "~> 1.0"},
       {:uuid_v7, "~> 0.6"},