diff --git a/cli/package.json b/cli/package.json
index 256291c2ef..34f4386115 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -53,7 +53,7 @@
     "@paperclipai/shared": "workspace:*",
     "@paperclipai/hermes-paperclip-adapter": "workspace:*",
     "drizzle-orm": "0.45.2",
-    "dotenv": "^17.0.1",
+    "dotenv": "^17.4.2",
     "commander": "^13.1.0",
     "embedded-postgres": "^18.1.0-beta.16",
     "picocolors": "^1.1.1"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index cb36a35404..f4b58f000a 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -88,8 +88,8 @@ importers:
         specifier: ^13.1.0
         version: 13.1.0
       dotenv:
-        specifier: ^17.0.1
-        version: 17.3.1
+        specifier: ^17.4.2
+        version: 17.4.2
       drizzle-orm:
         specifier: 0.45.2
         version: 0.45.2(@electric-sql/pglite@0.3.15)(kysely@0.29.2)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
@@ -753,8 +753,8 @@ importers:
         specifier: ^3.4.8
         version: 3.4.8
       dotenv:
-        specifier: ^17.0.1
-        version: 17.3.1
+        specifier: ^17.4.2
+        version: 17.4.2
       drizzle-orm:
         specifier: ^0.45.2
         version: 0.45.2(@electric-sql/pglite@0.3.15)(kysely@0.29.2)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
@@ -5685,8 +5685,8 @@ packages:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
 
-  dotenv@17.3.1:
-    resolution: {integrity: sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA==}
+  dotenv@17.4.2:
+    resolution: {integrity: sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==}
     engines: {node: '>=12'}
 
   downshift@7.6.2:
@@ -13009,7 +13009,7 @@ snapshots:
 
   dotenv@16.6.1: {}
 
-  dotenv@17.3.1: {}
+  dotenv@17.4.2: {}
 
   downshift@7.6.2(react@19.2.7):
     dependencies:
diff --git a/server/package.json b/server/package.json
index 188752d9d2..31834cdae1 100644
--- a/server/package.json
+++ b/server/package.json
@@ -66,7 +66,7 @@
     "chokidar": "^4.0.3",
     "detect-port": "^2.1.0",
     "dompurify": "^3.4.8",
-    "dotenv": "^17.0.1",
+    "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "embedded-postgres": "^18.1.0-beta.16",
     "express": "^5.1.0",