diff --git a/src/backend/pyproject.toml b/src/backend/pyproject.toml
index d6030b20..1171843f 100644
--- a/src/backend/pyproject.toml
+++ b/src/backend/pyproject.toml
@@ -28,6 +28,7 @@ dependencies = [
     "botocore==1.42.53",
     "celery[redis]==5.6.2",
     "cryptography==46.0.5",
+    "defusedxml==0.7.1",
     "dj-database-url==3.1.2",
     "django==5.2.11",
     "django-celery-beat==2.8.1",
diff --git a/src/backend/uv.lock b/src/backend/uv.lock
index c09ebbc1..3c726647 100644
--- a/src/backend/uv.lock
+++ b/src/backend/uv.lock
@@ -1124,6 +1124,7 @@ dependencies = [
     { name = "botocore" },
     { name = "celery", extra = ["redis"] },
     { name = "cryptography" },
+    { name = "defusedxml" },
     { name = "dj-database-url" },
     { name = "django" },
     { name = "django-celery-beat" },
@@ -1192,6 +1193,7 @@ requires-dist = [
     { name = "botocore", specifier = "==1.42.53" },
     { name = "celery", extras = ["redis"], specifier = "==5.6.2" },
     { name = "cryptography", specifier = "==46.0.5" },
+    { name = "defusedxml", specifier = "==0.7.1" },
     { name = "dj-database-url", specifier = "==3.1.2" },
     { name = "django", specifier = "==5.2.11" },
     { name = "django-celery-beat", specifier = "==2.8.1" },