diff --git a/Pipfile b/Pipfile
index 2fc1c4d9c2..17d3f82ab2 100644
--- a/Pipfile
+++ b/Pipfile
@@ -4,8 +4,9 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
-# If you add or bump packages here with native/compiled C/C++/Rust extensions,
-# make sure to also update src/platform_requirements.txt.
+# If you add or bump packages here that have native/compiled C/C++/Rust/CFFI
+# extensions (either directly or in their transitive dependencies in
+# src/Pipfile.lock), make sure to also update src/platform_requirements.txt.
 cryptography = "==37.0.4"
 crcmod = "==1.7"
 future = "==0.17.1"
diff --git a/src/Pipfile b/src/Pipfile
index 2a3efcb090..fcc7ac9ac8 100644
--- a/src/Pipfile
+++ b/src/Pipfile
@@ -4,6 +4,9 @@ verify_ssl = true
 name = "pypi"
 
 [packages]
+# If you add or bump packages here that have native/compiled C/C++/Rust/CFFI
+# extensions (either directly or in their transitive dependencies in
+# src/Pipfile.lock), make sure to also update src/platform_requirements.txt.
 antlr4-python3-runtime = "==4.7.2"
 bcrypt = "==4.1.2"
 certifi = "==2024.2.2"
diff --git a/src/platform_requirements.txt b/src/platform_requirements.txt
index 8f72f28810..102c1fc698 100644
--- a/src/platform_requirements.txt
+++ b/src/platform_requirements.txt
@@ -1,20 +1,23 @@
-# This file contains dependencies from src/Pipfile that contain native/compiled
-# C/C++/Rust extensions.
+# This file contains direct and transitive dependencies from src/Pipfile (and
+# src/Pipfile.lock) that contain native/compiled C/C++/Rust/CFFI extensions.
 #
 # When packaging bot deployment bundles for non-Linux platforms (e.g. Windows,
 # macOS, macOS ARM64) on a Linux build machine, butler uses this list to
 # download pre-compiled binary wheels for the target platform and extract them
 # into src/third_party.
 #
-# If you add or bump a package in Pipfile that has native extensions, make sure
-# to update it here as well.
+# If you add or bump a package in src/Pipfile that has native extensions (either
+# directly or via its transitive dependencies in src/Pipfile.lock), make sure to
+# update it here as well.
 bcrypt==4.1.2
 cffi==1.15.1
 cryptography==37.0.4
 google-crc32c==1.5.0
 grpcio==1.62.2
 kubernetes==34.1.0
+markupsafe==3.0.3
 protobuf==4.23.4
 psutil==5.9.4
+pynacl==1.6.0
 PyYAML==6.0.1
 wrapt==1.16.0
\ No newline at end of file