diff --git a/pyproject.toml b/pyproject.toml
index d51aefaa607..a6e0873f598 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -256,6 +256,7 @@ proxy-dev = [
     "opentelemetry-instrumentation-fastapi==0.49b0",
     "azure-identity==1.25.2",
     "a2a-sdk==1.1.0",
+    "pynacl>=1.6.2,<2.0",
 ]
 ci = [
     # These are lazily imported at call sites; keep them out of core deps to
diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/test_db_credentials.py b/tests/test_litellm/proxy/_experimental/mcp_server/test_db_credentials.py
index 9b171c18829..4b6062b52da 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/test_db_credentials.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/test_db_credentials.py
@@ -4,7 +4,7 @@ Tests for the encrypted-at-rest persistence of MCP user credentials.
 The ``LiteLLM_MCPUserCredentials.credential_b64`` column previously stored
 both BYOK API keys and OAuth2 access tokens as plain ``urlsafe_b64encode``
 of the raw value, leaving credentials readable from any DB read. The fix
-runs every write through ``encrypt_value_helper`` (nacl SecretBox) and
+runs every write through ``encrypt_value_helper`` (AES-256-GCM by default) and
 keeps a plain-base64 fallback on read so existing rows continue to work.
 """
 
diff --git a/uv.lock b/uv.lock
index cd0e564ccca..219b0a56981 100644
--- a/uv.lock
+++ b/uv.lock
@@ -4744,6 +4744,7 @@ proxy-dev = [
     { name = "opentelemetry-sdk" },
     { name = "prisma" },
     { name = "prometheus-client" },
+    { name = "pynacl" },
 ]
 
 [package.metadata]
@@ -4957,6 +4958,7 @@ proxy-dev = [
     { name = "opentelemetry-sdk", specifier = "==1.28.0" },
     { name = "prisma", specifier = "==0.11.0" },
     { name = "prometheus-client", specifier = "==0.20.0" },
+    { name = "pynacl", specifier = ">=1.6.2,<2.0" },
 ]
 
 [[package]]