diff --git a/pyproject.toml b/pyproject.toml
index 86038b9..522224b 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -63,7 +63,7 @@ dev = [
     "agentrust-trace-tests>=0.4,<0.6",
     # The bridge and real HTTP loopback run in the normal CI matrix. Pin the
     # tested SDK/server surface here; the public a2a-sdk extra remains a range.
-    "a2a-sdk[http-server]==1.1.4",
+    "a2a-sdk[http-server]==1.1.5",
     "uvicorn==0.53.0",
     "aiohttp>=3.14.3",
 ]
diff --git a/requirements/dev.in b/requirements/dev.in
index c4d9784..b16ded8 100644
--- a/requirements/dev.in
+++ b/requirements/dev.in
@@ -21,7 +21,7 @@ types-pyyaml
 bandit[toml]>=1.7
 pip-audit>=2.6
 agentrust-trace-tests>=0.4,<0.6
-a2a-sdk[http-server]==1.1.4
+a2a-sdk[http-server]==1.1.5
 uvicorn==0.53.0
 aiohttp>=3.14.3
 setuptools>=83.0.0
diff --git a/requirements/dev.txt b/requirements/dev.txt
index f304630..81b95a5 100644
--- a/requirements/dev.txt
+++ b/requirements/dev.txt
@@ -1,8 +1,8 @@
 # This file was autogenerated by uv via the following command:
 #    uv pip compile requirements/dev.in --generate-hashes --universal --python-version 3.11 -o requirements/dev.txt
-a2a-sdk==1.1.4 \
-    --hash=sha256:a77d7234d25e4b480626c09580c8cf4967d6beb0433ae139ac0eb15055fef128 \
-    --hash=sha256:b91b0350e1b1a3ef996b76766244523890d6b31b5aaf3f9d69c145fa97c5e0cf
+a2a-sdk==1.1.5 \
+    --hash=sha256:c1d63d36b79a097c62dd9be001fce21d5939f5a811a9c5afd0ba8082f13f68bf \
+    --hash=sha256:f81837f86a9bbb3ed4909539be642d61e8539ce8300a6578fa71dc901ee65b97
     # via -r requirements/dev.in
 agent-manifest==0.12.0 \
     --hash=sha256:ad8380f39d906054ff07852386bb5caeb3525c82126ccc6b5d463656ba41a8e1 \