diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts
index 18ad7558..e12f8ceb 100644
--- a/sigstore-java/build.gradle.kts
+++ b/sigstore-java/build.gradle.kts
@@ -34,7 +34,7 @@ dependencies {
     runtimeOnly("io.grpc:grpc-netty-shaded")
     compileOnly("org.apache.tomcat:annotations-api:6.0.53") // java 9+ only
 
-    implementation("commons-codec:commons-codec:1.18.0")
+    implementation("commons-codec:commons-codec:1.22.0")
     implementation("com.google.code.gson:gson:2.14.0")
     implementation("org.bouncycastle:bcutil-jdk18on:1.84")
     implementation("org.bouncycastle:bcpkix-jdk18on:1.84")