diff --git a/.github/workflows/build-pycurl.yml b/.github/workflows/build-pycurl.yml
index 6aa8a892eb2f..9ef321181412 100644
--- a/.github/workflows/build-pycurl.yml
+++ b/.github/workflows/build-pycurl.yml
@@ -153,10 +153,19 @@ jobs:
           # paramiko's cryptography/bcrypt deps have no riscv64 wheel below cp312;
           # fall back to the rest of the dev requirements so its sftp tests, which are
           # pytest.importorskip'd, skip instead of failing metadata generation.
+          # 7.49.0 replaced requirements-dev.txt with a `test` dependency group in
+          # pyproject.toml (`pip install --group test`); older releases still ship the file.
           CIBW_BEFORE_TEST_LINUX: >-
-            pip install flake8 -r {package}/requirements-dev.txt ||
-            { grep -v '^paramiko' {package}/requirements-dev.txt > /tmp/requirements-dev.txt &&
-              pip install flake8 -r /tmp/requirements-dev.txt; } &&
+            if [ -f {package}/requirements-dev.txt ]; then
+              pip install flake8 -r {package}/requirements-dev.txt ||
+              { grep -v '^paramiko' {package}/requirements-dev.txt > /tmp/requirements-dev.txt &&
+                pip install flake8 -r /tmp/requirements-dev.txt; };
+            else
+              pip install flake8 --group {package}/pyproject.toml:test ||
+              { pip install tomli &&
+                python -c "import tomli; print(*[r for r in tomli.load(open('{package}/pyproject.toml', 'rb'))['dependency-groups']['test'] if not r.startswith('paramiko')], sep='\n')" > /tmp/requirements-test.txt &&
+                pip install flake8 -r /tmp/requirements-test.txt; };
+            fi &&
             make -C {package}/tests/fake-curl/libcurl
           CIBW_TEST_COMMAND: pytest -v -ra {project}/tests
 
diff --git a/docs/packages/pycurl.yaml b/docs/packages/pycurl.yaml
index 01fb3d8e8560..dca72b3a61bd 100644
--- a/docs/packages/pycurl.yaml
+++ b/docs/packages/pycurl.yaml
@@ -52,3 +52,4 @@ versions:
   gpl-sources:
     filename: gpl-sources.tar
     description: gcc and the copyleft libraries bundled in the wheel
+- version: 7.49.0
diff --git a/patches/pycurl/7.49.0/0001-Widen-license-files-to-cover-bundled-third-party-lic.patch b/patches/pycurl/7.49.0/0001-Widen-license-files-to-cover-bundled-third-party-lic.patch
new file mode 100644
index 000000000000..50efca26f0c0
--- /dev/null
+++ b/patches/pycurl/7.49.0/0001-Widen-license-files-to-cover-bundled-third-party-lic.patch
@@ -0,0 +1,38 @@
+From 5b9d9b79074456e03a40c9ea7f4674fe1761bb92 Mon Sep 17 00:00:00 2001
+From: Ludovic Henry <git@ludovic.dev>
+Date: Fri, 4 Sep 2026 15:49:05 +0200
+Subject: [PATCH] Widen license-files to cover bundled third-party licences
+
+`license-files = ["COPYING-LGPL", "COPYING-MIT"]` is an explicit PEP 639
+list, so it replaces setuptools' default `LICEN[CS]E*` glob rather than
+adding to it: a `LICENSE.<dep>` dropped at the project root to cover a
+library `auditwheel repair` vendors into the wheel (libcurl and its
+transitive closure) is silently ignored. Widening the list to also match
+`LICENSE.*` picks those up with no other packaging change.
+
+Upstream's own manylinux wheels vendor a smaller set of the same libraries
+(via a statically-built vcpkg curl) and carry the identical gap: only
+COPYING-LGPL/COPYING-MIT ship in dist-info/licenses, with no notice for
+libcurl, OpenSSL, krb5, libssh2, brotli or nghttp2.
+
+Upstream-Status: To upstream [not submitted from this automated port run; needs a pull request against pycurl/pycurl]
+---
+ pyproject.toml | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index dbcdaa2..37d0044 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -8,7 +8,7 @@ description = "PycURL -- A Python Interface To The cURL library"
+ readme = "README.rst"
+ requires-python = ">=3.10"
+ license = "LGPL-2.1-only OR MIT"
+-license-files = ["COPYING-LGPL", "COPYING-MIT"]
++license-files = ["COPYING-LGPL", "COPYING-MIT", "LICENSE.*"]
+ keywords = ["curl", "libcurl", "urllib", "wget", "download", "file transfer", "http", "www"]
+ authors = [
+     { name = "Kjetil Jacobsen",         email = "kjetilja@gmail.com" },
+-- 
+2.43.0
+