diff --git a/pyproject.toml b/pyproject.toml
index b75cb51b..47be9d8d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -160,7 +160,7 @@ dev = [
     "pytest>=9.0.3; python_version >= '3.10'",
     "pytest-asyncio>=0.23",
     "ruff>=0.15.22,<0.17",
-    "pyright==1.1.411",
+    "pyright==1.1.413",
 ]
 # Everything needed to run the general offline gate in CI (lint + all safe extras-gated
 # tests) WITHOUT pulling torch/sentence-transformers — no test needs the real embedder.
@@ -171,7 +171,7 @@ test = [
     "pytest>=9.0.3; python_version >= '3.10'",
     "pytest-asyncio>=0.23",
     "ruff>=0.15.22,<0.17",
-    "pyright==1.1.411",
+    "pyright==1.1.413",
     "python-dotenv>=1.0",
     "uvicorn[standard]>=0.29",
     "fastapi>=0.133.1,<1; python_version >= '3.10'",
diff --git a/tests/test_release_infrastructure.py b/tests/test_release_infrastructure.py
index ff58eecf..af6a5595 100644
--- a/tests/test_release_infrastructure.py
+++ b/tests/test_release_infrastructure.py
@@ -446,7 +446,10 @@ def test_pyright_core_backend_ratchet_is_pinned_and_runs_in_ci_and_release():
     ci = _text(".github/workflows/ci.yml")
     release = _text(".github/workflows/release.yml")
 
-    assert pyproject.count('"pyright==1.1.411"') == 2
+    # Keep the dev and test extras on one exact, Dependabot-updatable Pyright pin.
+    pyright_pins = re.findall(r'"(pyright==[^"\n]+)"', pyproject)
+    assert len(pyright_pins) == 2
+    assert pyright_pins[0] == pyright_pins[1]
     assert '"engraphis/core",\n    "engraphis/backends",' in pyproject
     assert '"eval/harness.py",\n    "eval/external.py",' in pyproject
     assert 'pythonVersion = "3.9"' in pyproject