diff --git a/CHANGELOG.md b/CHANGELOG.md
index c71f079..f0a5ab3 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,12 @@ All notable changes to this project will be documented in this file. See [standa
 - Remove the external dotenvx executable dependency.
 - Remove the legacy setuptools build configuration.
 
+### Security
+
+- Upgrade PyO3 to 0.29.0, resolving its known iterator out-of-bounds read,
+  missing closure synchronization bound, and string conversion buffer-overflow
+  advisories.
+
 ## [0.3.0](https://github.com/dotenvx/dotenvx/compare/v0.2.6...v0.3.0)
 
 ### Added
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 4938a39..9ad0bf2 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -44,6 +44,26 @@ cargo check
 The `dotenvx-primitives` dependency version is independent. Change it only
 when this package should embed a newer primitives release.
 
+## Security audits
+
+Audit Rust dependencies in `Cargo.lock` with RustSec:
+
+```sh
+cargo install cargo-audit --locked
+cargo audit
+```
+
+Python's equivalent of `npm audit` is `pip-audit`:
+
+```sh
+python -m pip install pip-audit
+pip-audit .
+```
+
+This project currently has no runtime Python dependencies, but `pip-audit`
+should still be run whenever Python dependencies are added. Native dependencies
+embedded in the wheel are covered by `cargo audit`, not `pip-audit`.
+
 ## Publishing
 
 Git tags matching `v*` trigger wheel builds for Linux, macOS, and Windows and
diff --git a/pyproject.toml b/pyproject.toml
index 8b74934..a0c487f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -8,6 +8,7 @@ dynamic = ["version"]
 description = "a secure dotenv–from the creator of `dotenv`"
 readme = "README.md"
 requires-python = ">=3.8"
+dependencies = []
 license = { text = "BSD-3-Clause" }
 authors = [
   { name = "dotenv", email = "mot@dotenvx.com" }