diff --git a/awx/main/tests/functional/test_jobs.py b/awx/main/tests/functional/test_jobs.py
index aa2f996b5a..65117079c1 100644
--- a/awx/main/tests/functional/test_jobs.py
+++ b/awx/main/tests/functional/test_jobs.py
@@ -468,7 +468,7 @@ def test_run_job_cloud_credentials(job_template_with_credentials):
 
 
 @pytest.mark.django_db
-@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
+@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
 def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_credentials, mocker):
     """Test populate_workload_identity_tokens sets context when flag is enabled."""
     with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'):
@@ -529,7 +529,7 @@ def test_populate_workload_identity_tokens_with_flag_enabled(job_template_with_c
 
 
 @pytest.mark.django_db
-@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
+@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
 def test_populate_workload_identity_tokens_passes_workload_ttl_from_job_timeout(job_template_with_credentials, mocker):
     """Test populate_workload_identity_tokens passes workload_ttl_seconds from get_instance_timeout to the client."""
     with feature_flag_enabled('FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED'):
@@ -628,7 +628,7 @@ def test_populate_workload_identity_tokens_with_flag_disabled(job_template_with_
 
 
 @pytest.mark.django_db
-@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key', 'VALIDATE_HTTPS': False})
+@override_settings(RESOURCE_SERVER={'URL': 'https://gateway.example.com', 'SECRET_KEY': 'test-secret-key-at-least-32-bytes-long', 'VALIDATE_HTTPS': False})
 def test_populate_workload_identity_tokens_multiple_input_sources_per_credential(job_template_with_credentials, mocker):
     """Test that a single credential with two input sources from different workload identity
     credential types gets a separate JWT token for each input source, keyed by input source PK."""
diff --git a/requirements/requirements.in b/requirements/requirements.in
index 3cb7e3dc12..e8a5276269 100644
--- a/requirements/requirements.in
+++ b/requirements/requirements.in
@@ -49,6 +49,7 @@ psutil
 pyasn1>=0.6.2  # CVE-2026-2349
 pygerduty
 PyGithub
+PyJWT>=2.14.0  # CVE-2026-102268
 pyopenssl
 pyparsing>3.0 # Upgraded to v3 and changed import patterns
 python-daemon
diff --git a/requirements/requirements.txt b/requirements/requirements.txt
index c88ffb6a0a..777987f938 100644
--- a/requirements/requirements.txt
+++ b/requirements/requirements.txt
@@ -384,8 +384,9 @@ pygithub==2.8.1
     # via
     #   -r /awx_devel/requirements/requirements.in
     #   awx-plugins-core
-pyjwt[crypto]==2.10.1
+pyjwt[crypto]==2.15.1
     # via
+    #   -r /awx_devel/requirements/requirements.in
     #   adal
     #   django-ansible-base
     #   msal