diff --git a/CHANGELOG.md b/CHANGELOG.md
index 66e02304..b747f395 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,7 +3,9 @@
 ## Unreleased
 * Add `exe=@ENV` preference to read `JULIA_PYTHONCALL_EXE` without loading CondaPkg.
 * Improved TTFX in JuliaCall.
-* Minimum supported Python version is now 3.11.
+* Minimum supported Python version is now 3.11, and CondaPkg now installs a
+  security-supported patch release (3.11.18+, 3.12.16+, 3.13.18+, 3.14.10+ or
+  3.15.2+).
 
 ## 0.9.37 (2026-10-12)
 * Compatibility fix with Python 3.15 from conda-forge, which no longer bundles libpython.
diff --git a/CondaPkg.toml b/CondaPkg.toml
index 1bfcab9b..b88070e0 100644
--- a/CondaPkg.toml
+++ b/CondaPkg.toml
@@ -9,7 +9,7 @@ version = "<=julia"
 
 [deps.python]
 build = "**cpython**"
-version = ">=3.11,!=3.14.0,!=3.14.1,<4"
+version = ">=3.11.18,<3.12|>=3.12.16,<3.13|>=3.13.18,<3.14|>=3.14.10,<3.15|>=3.15.2,<4"
 
 [deps.libpython]
 build = "**bundled-or-separate**"
diff --git a/README.md b/README.md
index de141e65..ceef32a3 100644
--- a/README.md
+++ b/README.md
@@ -14,7 +14,7 @@ Bringing [**Python®**](https://www.python.org/) and [**Julia**](https://juliala
 - Fast non-copying conversion of numeric arrays in either direction: modify Python arrays (e.g. `bytes`, `array.array`, `numpy.ndarray`) from Julia or Julia arrays from Python.
 - Helpful wrappers: interpret Python sequences, dictionaries, arrays, dataframes and IO streams as their Julia counterparts, and vice versa.
 - Beautiful stack-traces.
-- Supports modern systems: tested on Windows, MacOS and Linux; 64-bit; Julia 1.10 upwards and Python 3.11 upwards.
+- Supports modern systems: tested on Windows, MacOS and Linux; 64-bit; Julia 1.10 upwards and Python 3.11 upwards, using a security-supported patch release.
 
 ⭐ If you like this, a GitHub star would be lovely thank you. ⭐
 
diff --git a/docs/src/faq.md b/docs/src/faq.md
index 5436fa17..ad774a81 100644
--- a/docs/src/faq.md
+++ b/docs/src/faq.md
@@ -112,7 +112,13 @@ np = pyimport("numpy")
 ## What versions of Python and Julia do you support?
 
 Each release of PythonCall and JuliaCall will support and require:
-- Any currently supported version of Python, [see here](https://devguide.python.org/versions/). Currently 3.11+.
+- Any currently supported version of Python, [see here](https://devguide.python.org/versions/). Currently 3.11+, using a security-supported patch release: 3.11.18+, 3.12.16+, 3.13.18+, 3.14.10+ or 3.15.2+.
 - The current Julia LTS version and newer, [see here](https://julialang.org/downloads/#long_term_support_release). Currently 1.10+.
 
 Only the latest patch release within each minor version is supported.
+
+By default CondaPkg installs a Python satisfying this policy, so updating PythonCall
+will upgrade Python automatically. If you must use an older patch release, for example
+a system Python which you cannot upgrade, set `exe` (or `JULIA_PYTHONCALL_EXE`) to that
+interpreter or use the CondaPkg `Null` backend. PythonCall only rejects Python older
+than 3.11.
diff --git a/docs/src/index.md b/docs/src/index.md
index 774b8f36..63e9abaf 100644
--- a/docs/src/index.md
+++ b/docs/src/index.md
@@ -7,4 +7,4 @@ Bringing [**Python®**](https://www.python.org/) and [**Julia**](https://juliala
 - Fast non-copying conversion of numeric arrays in either direction: modify Python arrays (e.g. `bytes`, `array.array`, `numpy.ndarray`) from Julia or Julia arrays from Python.
 - Helpful wrappers: interpret Python sequences, dictionaries, arrays, dataframes and IO streams as their Julia counterparts, and vice versa.
 - Beautiful stack-traces.
-- Works anywhere: tested on Windows, MacOS and Linux; 64-bit; Julia 1.10 upwards and Python 3.11 upwards.
+- Works anywhere: tested on Windows, MacOS and Linux; 64-bit; Julia 1.10 upwards and Python 3.11 upwards, using a security-supported patch release.