diff --git a/carbonserver/pyproject.toml b/carbonserver/pyproject.toml
index 78eb36ca5..8386df7e5 100644
--- a/carbonserver/pyproject.toml
+++ b/carbonserver/pyproject.toml
@@ -40,7 +40,7 @@ dependencies = [
     "joserfc>=1.0.0",
     "itsdangerous>=2.2.0",
     # Alembic depends on Mako but does not currently require the CVE-fixed version.
-    "mako>=1.3.12",
+    "mako>=1.4.2",
 ]
 
 [project.optional-dependencies]
diff --git a/carbonserver/uv.lock b/carbonserver/uv.lock
index 629941557..01ed4b562 100644
--- a/carbonserver/uv.lock
+++ b/carbonserver/uv.lock
@@ -145,7 +145,7 @@ requires-dist = [
     { name = "httpx", specifier = "<1.0.0" },
     { name = "itsdangerous", specifier = ">=2.2.0" },
     { name = "joserfc", specifier = ">=1.0.0" },
-    { name = "mako", specifier = ">=1.3.12" },
+    { name = "mako", specifier = ">=1.4.2" },
     { name = "mock", marker = "extra == 'dev'" },
     { name = "numpy" },
     { name = "psutil" },
@@ -459,14 +459,14 @@ wheels = [
 
 [[package]]
 name = "mako"
-version = "1.3.12"
+version = "1.4.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "markupsafe" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/00/62/791b31e69ae182791ec67f04850f2f062716bbd205483d63a215f3e062d3/mako-1.3.12.tar.gz", hash = "sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a", size = 400219, upload-time = "2026-04-28T19:01:08.512Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/05/7f/0b891a82379ffd96d2d8cc6d435fb1055cdaed52829287f81d2a43fd71cb/mako-1.4.2.tar.gz", hash = "sha256:7227a060ee3af55a493af61d73d6beef13044b81dba9586736c13945f09464ce", size = 412231, upload-time = "2026-09-22T20:40:55.06Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/bc/b1/a0ec7a5a9db730a08daef1fdfb8090435b82465abbf758a596f0ea88727e/mako-1.3.12-py3-none-any.whl", hash = "sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9", size = 78521, upload-time = "2026-04-28T19:01:10.393Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/bb/0e4c30a18858adebc75496ea8a8c3fb65cbf4b36ea1c5028ed8a0a5fa196/mako-1.4.2-py3-none-any.whl", hash = "sha256:e70a2a4308952b33a21208bfd6725da79fae5a8c224578f8cfdeb60e5ace03df", size = 80163, upload-time = "2026-09-22T20:40:56.423Z" },
 ]
 
 [[package]]
diff --git a/requirements/requirements-api.txt b/requirements/requirements-api.txt
index 44e1f561d..00ffe403a 100644
--- a/requirements/requirements-api.txt
+++ b/requirements/requirements-api.txt
@@ -546,9 +546,9 @@ joserfc==1.7.0 \
     # via
     #   carbonserver (carbonserver/pyproject.toml)
     #   authlib
-mako==1.3.12 \
-    --hash=sha256:8f61569480282dbf557145ce441e4ba888be453c30989f879f0d652e39f53ea9 \
-    --hash=sha256:9f778e93289bd410bb35daadeb4fc66d95a746f0b75777b942088b7fd7af550a
+mako==1.4.2 \
+    --hash=sha256:7227a060ee3af55a493af61d73d6beef13044b81dba9586736c13945f09464ce \
+    --hash=sha256:e70a2a4308952b33a21208bfd6725da79fae5a8c224578f8cfdeb60e5ace03df
     # via
     #   carbonserver (carbonserver/pyproject.toml)
     #   alembic