diff --git a/requirements.all.txt b/requirements.all.txt
index fee94fda71..fc6437eac8 100644
--- a/requirements.all.txt
+++ b/requirements.all.txt
@@ -132,7 +132,7 @@ uritemplate==4.2.0
 urllib3==2.6.3
 watchdog==6.0.0
 wcwidth==0.6.0
-werkzeug==3.1.5
+werkzeug==3.1.6
 wheel==0.46.3
 wrapt==2.1.1
 www-authenticate==0.9.2
diff --git a/requirements.txt b/requirements.txt
index 391dc0fe26..e66845d127 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -21,5 +21,5 @@ resumablehash==1.3  # match version with --find-links above
 rsa==4.7.2  # < 4.8, see https://github.com/DataBiosphere/azul/issues/6774. Resolve build-time dependency ambguity
 setuptools==82.0.0  # Match requirements.pip.txt. Python 3.12 removed distutils, which we depended on transitively. Luckily, setuptools includes a vendored copy.
 urllib3==2.6.3
-werkzeug==3.1.5
+werkzeug==3.1.6
 -r requirements.trans.txt