diff --git a/README.md b/README.md
index 4250f65..b63d393 100644
--- a/README.md
+++ b/README.md
@@ -123,13 +123,13 @@ with `qr_to_sheet.py`.
 ## Requirements
 
 - Python 3.9+
-- `pyscard`, `cryptography`, `openpyxl` (for reading legacy `.xlsx`), and
-  `opencv-python` (for QR decoding).
+- `pyscard` (smartcard access), `opencv-python` (QR decoding), and `openpyxl`
+  (reading legacy `.xlsx`). All cryptography uses the Python standard library.
 - For writing to a card: a PC/SC reader with the Apex (over NFC) or a JavaCard
   carrying the applet presented to it.
 
 ```
-pip install pyscard cryptography openpyxl opencv-python
+pip install -r requirements.txt
 ```
 
 ---
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..f8dd40a
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,9 @@
+# otp-import runtime dependencies (Python 3.9+)
+# Install with:  pip install -r requirements.txt
+#
+# All cryptography (PBKDF2, HMAC, Base32) uses the Python standard library,
+# so there is no separate crypto dependency.
+
+pyscard>=2.0         # PC/SC smartcard access (apex_otp_import.py)
+opencv-python>=4.5   # QR-code decoding (qr_to_sheet.py)
+openpyxl>=3.0        # reading legacy .xlsx input (apex_otp_import.py, tests)