diff --git a/changelog.d/16347.misc b/changelog.d/16347.misc
new file mode 100644
index 0000000000000000000000000000000000000000..f4f5bfb2de623d3786ffc6df695bbb7f20300e91
--- /dev/null
+++ b/changelog.d/16347.misc
@@ -0,0 +1 @@
+Pillow 10.0.1 is now mandatory because of libwebp CVE-2023-4863, since Pillow provides libwebp in the wheels.
diff --git a/pyproject.toml b/pyproject.toml
index 114411404141d2c76d362dad21953ab9146fa798..d66089a67df961ea5bd91b43787d5a424544347f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -174,7 +174,9 @@ PyYAML = ">=3.13"
 pyasn1 = ">=0.1.9"
 pyasn1-modules = ">=0.0.7"
 bcrypt = ">=3.1.7"
-Pillow = ">=5.4.0"
+# 10.0.1 minimum is mandatory here because of libwebp CVE-2023-4863.
+# Packagers that already took care of libwebp can lower that down to 5.4.0.
+Pillow = ">=10.0.1"
 # We use SortedDict.peekitem(), which was added in sortedcontainers 1.5.2.
 sortedcontainers = ">=1.5.2"
 pymacaroons = ">=0.13.0"