diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
new file mode 100644
index 0000000..07cc5e9
--- /dev/null
+++ b/.github/workflows/composer-require-checker.yml
@@ -0,0 +1,33 @@
+on:
+  pull_request:
+    paths-ignore:
+      - 'docs/**'
+      - 'README.md'
+      - 'CHANGELOG.md'
+      - '.gitignore'
+      - '.gitattributes'
+      - 'infection.json.dist'
+      - 'phpunit.xml.dist'
+      - 'psalm.xml'
+
+  push:
+    paths-ignore:
+      - 'docs/**'
+      - 'README.md'
+      - 'CHANGELOG.md'
+      - '.gitignore'
+      - '.gitattributes'
+      - 'infection.json.dist'
+      - 'phpunit.xml.dist'
+      - 'psalm.xml'
+
+name: Composer require checker
+
+jobs:
+  composer-require-checker:
+    uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
+    with:
+      os: >-
+        ['ubuntu-latest']
+      php: >-
+        ['7.4', '8.0', '8.1', '8.2']
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed7e04a..90cd716 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,8 @@
 
 ## 2.0.1 under development
 
-- no changes in this release.
+- Bug #36: Explicitly add transitive dependencies `yiisoft/strings`, `psr/http-server-handler`
+  and `ext-hash` (@vjik, @xepozz)
 
 ## 2.0.0 February 14, 2023
 
diff --git a/composer.json b/composer.json
index 1cef03d..5084c86 100644
--- a/composer.json
+++ b/composer.json
@@ -23,16 +23,20 @@
     },
     "require": {
         "php": "^7.4|^8.0",
+        "ext-hash": "*",
         "psr/http-factory": "^1.0",
         "psr/http-factory-implementation": "1.0",
         "psr/http-message": "^1.0",
         "psr/http-message-implementation": "1.0",
+        "psr/http-server-handler": "^1.0",
         "psr/http-server-middleware": "^1.0",
         "yiisoft/http": "^1.2",
         "yiisoft/security": "^1.0",
-        "yiisoft/session": "^1.0|^2.0"
+        "yiisoft/session": "^1.0|^2.0",
+        "yiisoft/strings": "^2.0"
     },
     "require-dev": {
+        "maglnet/composer-require-checker": "^3.8|^4.2",
         "nyholm/psr7": "^1.3",
         "phpunit/phpunit": "^9.5",
         "rector/rector": "^0.18.5",