diff --git a/CHANGELOG.md b/CHANGELOG.md
index be9712c..6b524ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,7 +1,7 @@
 ## Next Release
 Your contribution here.
 
-* [#000](https://github.com/bigcommerce/bigcommerce-api-ruby/pull/000): Brief description here. - [@username](https://github.com/username).
+* [#189](https://github.com/bigcommerce/bigcommerce-api-ruby/pull/189): Allow jwt v3 - [@zackgp](https://github.com/zackgp).
 
 ## 2.0.0
 
diff --git a/bigcommerce.gemspec b/bigcommerce.gemspec
index 0580103..15ddc4d 100644
--- a/bigcommerce.gemspec
+++ b/bigcommerce.gemspec
@@ -22,5 +22,5 @@ Gem::Specification.new do |s|
   s.add_dependency 'faraday', '>= 2.14', '< 3.0'
   s.add_dependency 'faraday-gzip', '~> 3.0'
   s.add_dependency 'hashie', '>= 3.4', '~> 4'
-  s.add_dependency 'jwt', '>= 1.5.4', '~> 2'
+  s.add_dependency 'jwt', '>= 1.5.4', '< 4'
 end
diff --git a/spec/bigcommerce/unit/resources/customers/customer_spec.rb b/spec/bigcommerce/unit/resources/customers/customer_spec.rb
index 34c5534..0cf2d1f 100644
--- a/spec/bigcommerce/unit/resources/customers/customer_spec.rb
+++ b/spec/bigcommerce/unit/resources/customers/customer_spec.rb
@@ -33,5 +33,13 @@
       expect(payload['iat']).to be <= Time.now.to_i
       expect(payload['jti']).to_not be_empty
     end
+
+    # Regression test for CVE-2026-45363 / GHSA-c32j-vqhx-rx3x, fixed in jwt 3.2.0.
+    context 'with jwt >= 3.2.0', if: Gem.loaded_specs['jwt'].version >= Gem::Version.new('3.2.0') do
+      it 'should reject empty/nil HMAC keys' do
+        expect { JWT.decode(subject, '', true, { algorithm: 'HS256' }) }.to raise_error(JWT::DecodeError)
+        expect { JWT.decode(subject, nil, true, { algorithm: 'HS256' }) }.to raise_error(JWT::DecodeError)
+      end
+    end
   end
 end