diff --git a/.changeset/undici-peer-dependency.md b/.changeset/undici-peer-dependency.md
new file mode 100644
index 000000000..de5072508
--- /dev/null
+++ b/.changeset/undici-peer-dependency.md
@@ -0,0 +1,5 @@
+---
+"@slack/bolt": patch
+---
+
+Declare `undici` as a peer dependency (`^7.28.0`). `@slack/bolt` constructs a `SocketModeClient` from `@slack/socket-mode@3`, which requires `undici@^7` as a peer. Consumers on strict package managers (Yarn Berry, pnpm) should install `undici` alongside `@slack/bolt`. The `^7.28.0` floor avoids `undici` releases affected by CVE-2026-12151 (GHSA-vxpw-j846-p89q), a high-severity WebSocket denial-of-service. Resolves #3039.
diff --git a/package-lock.json b/package-lock.json
index de005a304..8dc866cf0 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -45,7 +45,8 @@
         "npm": ">=9.6.4"
       },
       "peerDependencies": {
-        "@types/express": "^5.0.0"
+        "@types/express": "^5.0.0",
+        "undici": "^7.28.0"
       }
     },
     "node_modules/@babel/code-frame": {
@@ -4347,9 +4348,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "7.25.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-7.25.0.tgz",
-      "integrity": "sha512-xXnp4kTyor2Zq+J1FfPI6Eq3ew5h6Vl0F/8d9XU5zZQf1tX9s2Su1/3PiMmUANFULpmksxkClamIZcaUqryHsQ==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
       "license": "MIT",
       "peer": true,
       "engines": {
diff --git a/package.json b/package.json
index 04a32c4bb..e2b71edcb 100644
--- a/package.json
+++ b/package.json
@@ -79,6 +79,7 @@
     "typescript": "5.3.3"
   },
   "peerDependencies": {
-    "@types/express": "^5.0.0"
+    "@types/express": "^5.0.0",
+    "undici": "^7.28.0"
   }
 }