diff --git a/CHANGELOG.md b/CHANGELOG.md
index 9d77356cd..5f693ce7f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,6 +15,7 @@ _None_
 ### Bug Fixes
 
 - Bump `faraday` and `nokogiri` to address security vulnerabilities. [#749]
+- Bump `concurrent-ruby` to address CVE-2026-54904 / GHSA-h8w8-99g7-qmvj. [#751]
 
 ### Internal Changes
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 9b37967ee..a080543d9 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -83,7 +83,7 @@ GEM
     colored2 (3.1.2)
     commander (4.6.0)
       highline (~> 2.0.0)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
     cork (0.3.0)
       colored2 (~> 3.1)