diff --git a/requirements-server.txt b/requirements-server.txt
index f8b73c5..16e4b5d 100644
--- a/requirements-server.txt
+++ b/requirements-server.txt
@@ -1,8 +1,16 @@
 # Signal Bridge Remote — Server Dependencies
-fastapi>=0.109.0
-uvicorn[standard]>=0.27.0
-websockets>=12.0
-bcrypt>=4.1.0
-PyJWT>=2.8.0
-python-dotenv>=1.0.0
-python-multipart>=0.0.9
+#
+# PINNED on purpose (2026-07-30). An unpinned rebuild on 2026-07-27 silently
+# upgraded Starlette, which broke OAuth form parsing in production
+# (python-multipart was missing from the deployed copy of this file).
+# These are the exact versions verified running together on the droplet.
+# To upgrade: bump deliberately, rebuild, and test the OAuth sign-in flow
+# (GET+POST /oauth/authorize) before walking away.
+fastapi==0.141.1
+starlette==1.3.1
+uvicorn[standard]==0.52.0
+websockets==17.0
+bcrypt==5.0.0
+PyJWT==2.13.0
+python-dotenv==1.2.2
+python-multipart==0.0.32