diff --git a/indico_rock/requirements.txt b/indico_rock/requirements.txt
index e01e4857..cb83aca4 100644
--- a/indico_rock/requirements.txt
+++ b/indico_rock/requirements.txt
@@ -12,12 +12,12 @@ indico-plugin-storage-s3
 
 # SAML support libraries (carried over from the indico-operator rock). xmlsec
 # is compiled here at build time where the toolchain is available.
-xmlsec==1.3.15
+xmlsec==1.3.17
 python3-saml
 
 # Pinned to dodge https://github.com/boto/boto3/issues/4398 which breaks
 # indico-plugin-storage-s3.
-boto3==1.35.99
+boto3==1.43.70
 
 # Local CLI plugins (carried over from indico-operator) that back the
 # add-admin and anonymize-user charm actions: `indico autocreate admin` and
diff --git a/terraform/product/terraform.tf b/terraform/product/terraform.tf
index 24de60f9..970c3a86 100644
--- a/terraform/product/terraform.tf
+++ b/terraform/product/terraform.tf
@@ -6,7 +6,7 @@ terraform {
   required_providers {
     vault = {
       source  = "hashicorp/vault"
-      version = "~> 5.9.0"
+      version = "~> 5.10.0"
     }
     juju = {
       source  = "juju/juju"