diff --git a/CHANGELOG.md b/CHANGELOG.md
index caf437c..d088e6b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -118,6 +118,11 @@
 - Fix an error with URL generation for authenticated requests.
 - Fix error handling for IdentityServer4 provider.
 
+## 1.0.36 - 2025-01-03
+
+### Changed
+- Lock `league/oauth2-client` to `2.7.0` to prevent an issue with refresh token scopes on some providers.
+
 ## 1.0.35 - 2024-10-20
 
 ### Added
diff --git a/composer.json b/composer.json
index 37d2b70..0e73902 100644
--- a/composer.json
+++ b/composer.json
@@ -23,7 +23,7 @@
         "jakeasmith/http_build_url": "^1.0",
         "lcobucci/jwt": "^3.4 || ^4.0",
         "league/oauth1-client": "^1.9",
-        "league/oauth2-client": "^2.0",
+        "league/oauth2-client": "2.7.0",
         "mollie/mollie-api-php": "^1.19 || ^2.39",
         "paragonie/random-lib": "^2.0",
         "psr/http-message": "^1.0 || ^2.0",