diff --git a/api/package.json b/api/package.json
index 6199339d659..82af5235c47 100644
--- a/api/package.json
+++ b/api/package.json
@@ -19,7 +19,7 @@
     "ajv-formats": "3.0.1",
     "date-fns": "4.1.0",
     "date-fns-tz": "3.2.0",
-    "dotenv": "16.4.5",
+    "dotenv": "16.6.1",
     "fast-uri": "2.3.0",
     "fastify": "5.2.0",
     "fastify-plugin": "5.0.1",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2b7cb4c08f9..1bc66f0de0c 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -138,8 +138,8 @@ importers:
         specifier: 3.2.0
         version: 3.2.0(date-fns@4.1.0)
       dotenv:
-        specifier: 16.4.5
-        version: 16.4.5
+        specifier: 16.6.1
+        version: 16.6.1
       fast-uri:
         specifier: 2.3.0
         version: 2.3.0
@@ -23184,7 +23184,7 @@ snapshots:
   dotenv-cli@7.4.4:
     dependencies:
       cross-spawn: 7.0.6
-      dotenv: 16.4.5
+      dotenv: 16.6.1
       dotenv-expand: 10.0.0
       minimist: 1.2.8
 
@@ -30302,7 +30302,7 @@ snapshots:
   static-browser-server@1.0.3:
     dependencies:
       '@open-draft/deferred-promise': 2.2.0
-      dotenv: 16.4.5
+      dotenv: 16.6.1
       mime-db: 1.54.0
       outvariant: 1.4.0