diff --git a/Sandbox/README.md b/Sandbox/README.md
index 5abe3d4b..696703a3 100644
--- a/Sandbox/README.md
+++ b/Sandbox/README.md
@@ -30,7 +30,7 @@ This folder holds the VM's side. The app's side is in
 
 Tests need nothing but `python3`. Tests that need `pypdf` or `trafilatura` skip
 when they are missing; in a virtual environment,
-`pip install trafilatura==2.3.0 pypdf==6.20.0` runs them all. (Do not use
+`pip install trafilatura==2.3.0 pypdf==6.21.1` runs them all. (Do not use
 `requirements.txt` for that on a Mac: its hashes are for the image's Linux
 platform.)
 
diff --git a/Sandbox/requirements.in b/Sandbox/requirements.in
index 5e834c87..61689e82 100644
--- a/Sandbox/requirements.in
+++ b/Sandbox/requirements.in
@@ -5,4 +5,4 @@
 trafilatura==2.3.0
 # pypdf reads PDFs inside the bounded child process (pure Python, BSD-3-Clause;
 # no crypto or image extras, so encrypted PDFs are refused, not decrypted).
-pypdf==6.20.0
+pypdf==6.21.1
diff --git a/Sandbox/requirements.txt b/Sandbox/requirements.txt
index e5535315..32d4db13 100644
--- a/Sandbox/requirements.txt
+++ b/Sandbox/requirements.txt
@@ -386,9 +386,9 @@ lxml-html-clean==0.4.5 \
     --hash=sha256:c76fcadd1e5bfb9b8bafc2200d51e4e78eb0dad67f56881c21dfb6484c7e7746 \
     --hash=sha256:e2a4c7d5beedd17cd7b484d848a0571e54baa239a4f9df5546e3acba7f990560
     # via lxml
-pypdf==6.20.0 \
-    --hash=sha256:72b1e897fef7f5bbed7f2a93881a4861d98dbf25ae39981c8a023583239edbda \
-    --hash=sha256:f003fc2014814d264fe7dd3f9d435c158e23e1a85a2233f87a0a2d6d21c914ad
+pypdf==6.21.1 \
+    --hash=sha256:2d62c383acd6e0dff0a96322ba8b1135229343b084d73c6f6cfd947fd291afcb \
+    --hash=sha256:553e2d42f5bb3bb2a785a7d3de8ef90bb7df74b5413eff5a7b4388007ea9254b
     # via -r requirements.in
 python-dateutil==2.9.0.post0 \
     --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \
diff --git a/THIRD_PARTY_NOTICES.md b/THIRD_PARTY_NOTICES.md
index 58822d32..0cc68f4f 100644
--- a/THIRD_PARTY_NOTICES.md
+++ b/THIRD_PARTY_NOTICES.md
@@ -107,7 +107,7 @@ preserve the license and NOTICE material of its exact contents.
 | Package | Version | License |
 | --- | --- | --- |
 | [trafilatura](https://github.com/adbar/trafilatura) | 2.3.0 | Apache-2.0 |
-| [pypdf](https://github.com/py-pdf/pypdf) | 6.20.0 | BSD-3-Clause |
+| [pypdf](https://github.com/py-pdf/pypdf) | 6.21.1 | BSD-3-Clause |
 | [courlan](https://github.com/adbar/courlan) | 1.4.0 | Apache-2.0 |
 | [htmldate](https://github.com/adbar/htmldate) | 1.11.0 | Apache-2.0 |
 | [jusText](https://github.com/miso-belica/jusText) | 3.0.2 | BSD-2-Clause |