diff --git a/certbot-dns-cloudflare/setup.py b/certbot-dns-cloudflare/setup.py
index 32eb6fbb5..d31c44b38 100644
--- a/certbot-dns-cloudflare/setup.py
+++ b/certbot-dns-cloudflare/setup.py
@@ -9,7 +9,7 @@ version = '3.2.0.dev0'
 install_requires = [
     # for now, do not upgrade to cloudflare>=2.20 to avoid deprecation warnings and the breaking
     # changes in version 3.0. see https://github.com/certbot/certbot/issues/9938
-    'cloudflare>=1.5.1, <2.20',
+    'cloudflare>=2.19, <2.20',
 ]
 
 if os.environ.get('SNAP_BUILD'):
diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index 02a2bd897..0d4479de7 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -19,6 +19,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 * Directory hooks are now run on all commands by default, not just `renew`
 * Help output now shows `False` as default when it can be set via `cli.ini` instead of `None`
 * Changed terms of service agreement text to have a newline after the TOS link
+* certbot-cloudflare-dns is now pinned to version 2.19 of Cloudflare's python library
 
 ### Fixed
 
diff --git a/tools/oldest_constraints.txt b/tools/oldest_constraints.txt
index 3b8caa427..087a00fb0 100644
--- a/tools/oldest_constraints.txt
+++ b/tools/oldest_constraints.txt
@@ -3,6 +3,7 @@
 apacheconfig==0.3.2 ; python_version >= "3.9" and python_version < "3.10"
 asn1crypto==0.24.0 ; python_version >= "3.9" and python_version < "3.10"
 astroid==3.3.8 ; python_version >= "3.9" and python_version < "3.10"
+attrs==25.1.0 ; python_version >= "3.9" and python_version < "3.10"
 beautifulsoup4==4.13.3 ; python_version >= "3.9" and python_version < "3.10"
 boto3==1.15.15 ; python_version >= "3.9" and python_version < "3.10"
 botocore==1.18.15 ; python_version >= "3.9" and python_version < "3.10"
@@ -10,7 +11,7 @@ cachetools==5.5.1 ; python_version >= "3.9" and python_version < "3.10"
 certifi==2025.1.31 ; python_version >= "3.9" and python_version < "3.10"
 cffi==1.12.3 ; python_version >= "3.9" and python_version < "3.10"
 chardet==3.0.4 ; python_version >= "3.9" and python_version < "3.10"
-cloudflare==1.5.1 ; python_version >= "3.9" and python_version < "3.10"
+cloudflare==2.19.0 ; python_version >= "3.9" and python_version < "3.10"
 colorama==0.4.6 ; python_version >= "3.9" and python_version < "3.10" and sys_platform == "win32"
 configargparse==1.5.3 ; python_version >= "3.9" and python_version < "3.10"
 configobj==5.0.6 ; python_version >= "3.9" and python_version < "3.10"
@@ -36,8 +37,8 @@ iniconfig==2.0.0 ; python_version >= "3.9" and python_version < "3.10"
 ipaddress==1.0.16 ; python_version >= "3.9" and python_version < "3.10"
 isort==6.0.0 ; python_version >= "3.9" and python_version < "3.10"
 jmespath==0.10.0 ; python_version >= "3.9" and python_version < "3.10"
-josepy==1.14.0 ; python_version >= "3.9" and python_version < "3.10"
-logger==1.4 ; python_version >= "3.9" and python_version < "3.10"
+josepy==1.15.0 ; python_version >= "3.9" and python_version < "3.10"
+jsonlines==4.0.0 ; python_version >= "3.9" and python_version < "3.10"
 mccabe==0.7.0 ; python_version >= "3.9" and python_version < "3.10"
 mypy-extensions==1.0.0 ; python_version >= "3.9" and python_version < "3.10"
 mypy==1.15.0 ; python_version >= "3.9" and python_version < "3.10"
diff --git a/tools/pinning/oldest/pyproject.toml b/tools/pinning/oldest/pyproject.toml
index 2afad9a5e..142ba4881 100644
--- a/tools/pinning/oldest/pyproject.toml
+++ b/tools/pinning/oldest/pyproject.toml
@@ -58,7 +58,7 @@ boto3 = "1.15.15"
 botocore = "1.18.15"
 cffi = "1.12.3"
 chardet = "3.0.4"
-cloudflare = "1.5.1"
+cloudflare = "2.19"
 configobj = "5.0.6"
 cryptography = "43.0.0"
 distro = "1.0.1"