diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6ff0e8..017f667 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.1.2 — 2026-10-09
+
+- Require Symfony Process 8.0.5 or newer to exclude CVE-2026-24739 from consumer dependency resolution.
+
 ## 0.1.1 — 2026-10-06
 
 - Use stable Starter 1.1.8 for new projects instead of the removed development branch.
diff --git a/composer.json b/composer.json
index c93bc7e..e93e63c 100644
--- a/composer.json
+++ b/composer.json
@@ -15,7 +15,7 @@
         "ext-json": "*",
         "symfony/console": "^8.0",
         "symfony/filesystem": "^8.0",
-        "symfony/process": "^8.0"
+        "symfony/process": "^8.0.5"
     },
     "require-dev": {
         "phpstan/phpstan": "^2.2",