diff --git a/.github/workflows/security_scan.yaml b/.github/workflows/security_scan.yaml
index 24cf85949f..20d9784eeb 100644
--- a/.github/workflows/security_scan.yaml
+++ b/.github/workflows/security_scan.yaml
@@ -18,7 +18,7 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4.3.1
 
       - name: Ensure .trivyignore exists
         run: |
@@ -30,7 +30,7 @@ jobs:
           fi
 
       - name: Run Trivy scan for logs
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.33.1
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -38,7 +38,7 @@ jobs:
           trivyignores: ".trivyignore"
 
       - name: Run Trivy scan for SARIF report
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.33.1
         with:
           scan-type: "fs"
           scan-ref: "."
@@ -48,7 +48,7 @@ jobs:
           output: "trivy-results.sarif"
 
       - name: Upload SARIF to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3.29.6
+        uses: github/codeql-action/upload-sarif@v3.31.5
         with:
           sarif_file: "trivy-results.sarif"
 
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@v4.3.1
 
       - name: Ensure .trivyignore exists
         run: |
@@ -76,7 +76,7 @@ jobs:
           fi
 
       - name: Run Trivy to generate SBOM
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@0.33.1
         with:
           scan-type: "fs"
           scan-ref: "."
diff --git a/base_requirements.txt b/base_requirements.txt
index 4c20cc3459..66558b53c4 100644
--- a/base_requirements.txt
+++ b/base_requirements.txt
@@ -5,8 +5,8 @@ ops>=2.8
 pylxd @ git+https://github.com/canonical/pylxd
 requests
 typing-extensions
-cryptography==45.0.5
-pydantic ==1.10.22
-cosl ==1.0.0
+cryptography==45.0.7
+pydantic ==1.10.24
+cosl ==1.4.0
 PyYAML ==6.0.*
-pyOpenSSL==25.1.0
+pyOpenSSL==25.3.0
diff --git a/github-runner-manager/requirements.txt b/github-runner-manager/requirements.txt
index a11a02eac5..8679556f1f 100644
--- a/github-runner-manager/requirements.txt
+++ b/github-runner-manager/requirements.txt
@@ -1,10 +1,10 @@
-click==8.2.1
+click==8.3.1
 fabric >=3,<4
-flask==3.1.1
+flask==3.1.2
 ghapi
 jinja2
-kombu==5.5.3
-openstacksdk==4.5.0
-prometheus-client==0.22.1
+kombu==5.6.1
+openstacksdk==4.8.0
+prometheus-client==0.23.1
 pydantic < 2
-pymongo==4.13.0
+pymongo==4.15.4
diff --git a/github-runner-manager/tests/unit/requirements.txt b/github-runner-manager/tests/unit/requirements.txt
index 20ee3d31e1..b73145d47a 100644
--- a/github-runner-manager/tests/unit/requirements.txt
+++ b/github-runner-manager/tests/unit/requirements.txt
@@ -1 +1 @@
-factory-boy==3.3.1
+factory-boy==3.3.3
diff --git a/tests/integration/requirements.txt b/tests/integration/requirements.txt
index 062f66c0ba..cc0ab7d196 100644
--- a/tests/integration/requirements.txt
+++ b/tests/integration/requirements.txt
@@ -1,5 +1,5 @@
 GitPython>3,<4
-jubilant==1.1.*
+jubilant==1.6.*
 kombu==5.*
 pygithub
 pymongo==4.*