diff --git a/CHANGELOG.md b/CHANGELOG.md
index 85bbfc57c8f..139a2359402 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@
 - Keep UI profiling running when `startProfiler` is called before a requested stop takes effect at the end of the current chunk ([#6291](https://github.com/getsentry/sentry-java/pull/6291))
   - Before, the start call was ignored and the profiler still stopped at the end of the chunk, even in `TRACE` mode while sampled spans were active. On API 34 and lower, every later profile also stopped after one chunk.
 
+### Dependencies
+
+- Bump epitaph (Android tombstone parsing) from 0.1.1 to 0.2.0 ([#6402](https://github.com/getsentry/sentry-java/pull/6402))
+  - Reject malformed protobuf tags, oversized lengths, invalid varints, and invalid reader bounds instead of silently accepting partial/corrupt tombstone data.
+
 ## 8.62.0
 
 ### Improvements
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 7cbe8e626c8..09e512be55f 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -183,7 +183,7 @@ otel-javaagent-extension-api = { module = "io.opentelemetry.javaagent:openteleme
 otel-semconv = { module = "io.opentelemetry.semconv:opentelemetry-semconv", version.ref = "otelSemanticConventions" }
 otel-semconv-incubating = { module = "io.opentelemetry.semconv:opentelemetry-semconv-incubating", version.ref = "otelSemanticConventionsAlpha" }
 p6spy = { module = "p6spy:p6spy", version = "3.9.1" }
-epitaph = { module = "com.abovevacant:epitaph", version = "0.1.1" }
+epitaph = { module = "com.abovevacant:epitaph", version = "0.2.0" }
 jcache = { module = "javax.cache:cache-api", version = "1.1.1" }
 quartz = { module = "org.quartz-scheduler:quartz", version = "2.3.0" }
 reactor-core = { module = "io.projectreactor:reactor-core", version = "3.5.3" }