diff --git a/.gitignore b/.gitignore
index 679dfaf..bfb618f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,3 +6,6 @@ docs/_build
 coverage.xml
 _build
 uv.lock
+*.egg-info
+__pycache__/*
+*.pyc
diff --git a/docs/changelog.rst b/docs/changelog.rst
index 276ad5c..3a9ba8f 100644
--- a/docs/changelog.rst
+++ b/docs/changelog.rst
@@ -2,6 +2,12 @@
 Changelog
 =========
 
+- :support:`45` Require ``pip>=26.1``, which fixes several CVEs reported
+  against older pip releases. pip 26.1 needs Python 3.10, so Python 3.9 is no
+  longer supported.
+- :support:`-` Require ``sphinx<9``. Sphinx 9 retired the class-based
+  ``Documenter`` API that ``invocations.autodoc`` extends, so tasks stop
+  showing up in ``automodule`` output when it is installed.
 - :feature:`-` Updated the ``--clean`` flag in ``packaging.release.build`` to
   clean any ``build/`` directories in the source root, on top of the previous
   behavior of cleaning out ``dist/``. This helps prevent wacky state bleed
diff --git a/docs/conf.py b/docs/conf.py
index b0199d9..ac06560 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -60,9 +60,9 @@
     dirname(__file__), "..", "..", "invoke", "sites", "docs", "_build"
 )
 if not on_dev:
-    inv_target = "http://docs.pyinvoke.org/en/latest/"
+    inv_target = "https://docs.pyinvoke.org/en/latest/"
 # Put them all together, + Python core
 intersphinx_mapping = {
-    "python": ("http://docs.python.org/", None),
+    "python": ("https://docs.python.org/3/", None),
     "invoke": (inv_target, None),
 }
diff --git a/pyproject.toml b/pyproject.toml
index faddf81..d0f7449 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,6 +1,6 @@
 [project]
 name = "invocations"
-requires-python = ">=3.9"
+requires-python = ">=3.10"
 version = "4.1.0"
 description = "Common/best-practice Invoke tasks and collections"
 readme = "README.rst"
@@ -19,9 +19,12 @@ dependencies = [
   "blessings>=1.6",
   "build>=1.3",
   # For envs that don't actually have pip - we use some of its tooling atm.
-  "pip>=25.1",
+  "pip>=26.1",
   "releases>=1.6",
   "semantic_version>=2.4,<2.7",
+  # Our autodoc extension subclasses Sphinx's class-based Documenter API,
+  # which Sphinx 9 retired for automodule member dispatch.
+  "sphinx<9",
   "tabulate>=0.7.5",
   "tqdm>=4.8.1",
   "twine>=1.15",
@@ -40,7 +43,6 @@ classifiers = [
   "Programming Language :: Python",
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3 :: Only",
-  "Programming Language :: Python :: 3.9",
   "Programming Language :: Python :: 3.10",
   "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
@@ -76,11 +78,12 @@ dev = [
   # Oldest version that works on Python >3.11
   "watchdog==1.0.2",
   "coverage==4.4.2",
-  "icecream==2.1.3",
+  "icecream==2.2.0",
   # Formatting
   "black==22.12.0",
   # Linting
   "flake8~=7.3.0",
+  "ruff~=0.15"
 ]
 
 [tool.ruff]