diff --git a/api/package.json b/api/package.json
index bb521ff..dcf2dca 100644
--- a/api/package.json
+++ b/api/package.json
@@ -17,7 +17,7 @@
     "@fastify/rate-limit": "^10.3.0",
     "@grov/shared": "workspace:*",
     "@supabase/supabase-js": "^2.79.0",
-    "dotenv": "^16.4.5",
+    "dotenv": "^17.2.3",
     "fastify": "^5.6.2",
     "jose": "^6.1.2",
     "openai": "^4.70.0",
diff --git a/package.json b/package.json
index 437465c..c61aa91 100644
--- a/package.json
+++ b/package.json
@@ -68,7 +68,7 @@
     "better-sqlite3": "^11.6.0",
     "commander": "^12.1.0",
     "debug": "^4.4.3",
-    "dotenv": "^16.4.5",
+    "dotenv": "^17.2.3",
     "fastify": "^5.6.2",
     "open": "^11.0.0",
     "openai": "^4.70.0",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e0f3040..acd2286 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -21,8 +21,8 @@ importers:
         specifier: ^4.4.3
         version: 4.4.3
       dotenv:
-        specifier: ^16.4.5
-        version: 16.6.1
+        specifier: ^17.2.3
+        version: 17.2.3
       fastify:
         specifier: ^5.6.2
         version: 5.6.2
@@ -85,8 +85,8 @@ importers:
         specifier: ^2.79.0
         version: 2.87.1
       dotenv:
-        specifier: ^16.4.5
-        version: 16.6.1
+        specifier: ^17.2.3
+        version: 17.2.3
       fastify:
         specifier: ^5.6.2
         version: 5.6.2
@@ -1931,8 +1931,8 @@ packages:
   domutils@3.2.2:
     resolution: {integrity: sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==}
 
-  dotenv@16.6.1:
-    resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
+  dotenv@17.2.3:
+    resolution: {integrity: sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==}
     engines: {node: '>=12'}
 
   dset@3.1.4:
@@ -5186,7 +5186,7 @@ snapshots:
       domelementtype: 2.3.0
       domhandler: 5.0.3
 
-  dotenv@16.6.1: {}
+  dotenv@17.2.3: {}
 
   dset@3.1.4: {}