diff --git a/ChangeLog b/ChangeLog
index cc14812..a8ca60b 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 == Unreleased
 
+* Require HTTPClient 2.10.0 or later for its compromised eMudhra intermediate CA
+  public key rejection and updated CA bundle.
+
 * Breaking: Remove the bundled CA certificates and delegate default CA selection
   to HTTPClient. Regular API requests can trust a different set of issuers after
   upgrading; review custom endpoints and TLS inspection proxies.
diff --git a/td-client.gemspec b/td-client.gemspec
index 59f11c0..1afb4d8 100644
--- a/td-client.gemspec
+++ b/td-client.gemspec
@@ -18,7 +18,7 @@ Gem::Specification.new do |gem|
   gem.license       = "Apache-2.0"
 
   gem.add_dependency "msgpack", ">= 0.5.6", "< 2"
-  gem.add_dependency "httpclient", ">= 2.7"
+  gem.add_dependency "httpclient", ">= 2.10.0"
   gem.add_development_dependency "rspec", "~> 3.0"
   gem.add_development_dependency 'coveralls_reborn'
   gem.add_development_dependency "webmock", "~> 3.25.1"