diff --git a/pyproject.toml b/pyproject.toml
index 13f1d88..4e77122 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -16,7 +16,7 @@ dependencies = [
     # tracks each mirror's default branch, so an install made before a mirror's release
     # freezes on whatever was HEAD then and never refreshes — that is how a local install
     # ran stale measure-mirror 0.14.3 long after 0.15.1 landed. Bump these on purpose.
-    "measure-mirror @ git+https://github.com/mirror-stack/measure-mirror@690c27e9645878576f7284bdcc9b7cafdf7c0f53",   # v0.27.0 — full 64-hex SHA-256 seals (security, SPEC v1.1); v0.26.1 ㉗ prereg_lint false-positive fix (declared-chance floor); v0.26.0 ㉗ prereg_lint probe + pre_seal_checks (required by mm_prereg_lint/gate wiring); v0.24~0.25 grounding/anchor probes ㉑–㉕
+    "measure-mirror @ git+https://github.com/mirror-stack/measure-mirror@28290f2ba",   # v0.28.0 — SECURITY: verify_chain no longer waives the chain link on missing prev_seal (SPEC §4 rule 3); v0.27.0 full 64-hex seals; v0.26 ㉗ prereg_lint
     "action-mirror @ git+https://github.com/mirror-stack/action-mirror@fa1fc4998936e6bf179b5c14825fb09e78a36087",     # v0.2.0 — full 64-hex SHA-256 seals (security; legacy 16-hex verify via prefix match); v0.1.0 ledgers conform to MIRROR-SPEC v1.0
     "provenance-mirror @ git+https://github.com/mirror-stack/provenance-mirror@321f84abc4ffd91da43a5ebc866b5ce02cf3c276",  # v0.2.0 — full 64-hex SHA-256 seals (security; legacy 16-hex verify via prefix match); v0.1.0 ledgers conform to MIRROR-SPEC v1.0
 ]