diff --git a/changelog.md b/changelog.md
index 282d78f..8036118 100644
--- a/changelog.md
+++ b/changelog.md
@@ -9,6 +9,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- **SECURITY** Pin Santuario to 2.3.4. OpenSAML 4.0.1 resolves 2.1.4 transitively, which predates
+  CVE-2021-40690 - `secureValidation` is not carried through when a `KeyInfo` is built from a
+  `KeyInfoReference` - and Santuario is what actually verifies the assertion signatures this library
+  exists to check. 2.3.x is the patched line that keeps the 2.x API OpenSAML 4 compiles against.
+
 ## [3.0.0] - 2026-08-25
 
 ### Added
diff --git a/java/cbsso-opensaml/app/build.gradle b/java/cbsso-opensaml/app/build.gradle
index 0ff7a9b..871c0d7 100644
--- a/java/cbsso-opensaml/app/build.gradle
+++ b/java/cbsso-opensaml/app/build.gradle
@@ -40,6 +40,11 @@ dependencies {
     implementation "org.opensaml:opensaml-security-impl:$opensamlVersion"
     implementation "org.opensaml:opensaml-profile-api:$opensamlVersion"
 
+    // OpenSAML 4.0.1 resolves Santuario 2.1.4, which predates CVE-2021-40690 - secureValidation is
+    // not carried into a KeyInfo built from a KeyInfoReference - and this library exists to validate
+    // SAML signatures. 2.3.x is the patched line that keeps the 2.x API OpenSAML 4 compiles against.
+    implementation "org.apache.santuario:xmlsec:2.3.4"
+
     implementation "org.slf4j:slf4j-api:1.7.36"
     implementation "org.slf4j:slf4j-simple:1.7.36"
 }