diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed7e04a..147aeeb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## 2.0.1 under development
 
-- no changes in this release.
+- Bug #36: Explicitly add transitive dependencies `yiisoft/strings` and `psr/http-server-handler` (@vjik, @xepozz)
 
 ## 2.0.0 February 14, 2023
 
diff --git a/composer.json b/composer.json
index 4eaa899..fc18c62 100644
--- a/composer.json
+++ b/composer.json
@@ -27,10 +27,12 @@
         "psr/http-factory-implementation": "1.0",
         "psr/http-message": "^1.0",
         "psr/http-message-implementation": "1.0",
+        "psr/http-server-handler": "^1.0",
         "psr/http-server-middleware": "^1.0",
         "yiisoft/http": "^1.2",
         "yiisoft/security": "^1.0",
-        "yiisoft/session": "^1.0|^2.0"
+        "yiisoft/session": "^1.0|^2.0",
+        "yiisoft/strings": "^2.2"
     },
     "require-dev": {
         "maglnet/composer-require-checker": "^3.8|^4.2",