diff --git a/incubator/lint-lockfile/package.json b/incubator/lint-lockfile/package.json
index 5e534f4eb..865fa94ed 100644
--- a/incubator/lint-lockfile/package.json
+++ b/incubator/lint-lockfile/package.json
@@ -29,7 +29,7 @@
     "@rnx-kit/config": "^1.0.0",
     "@rnx-kit/tools-workspaces": "^0.2.6",
     "@rnx-kit/types-kit-config": "^2.0.0",
-    "js-yaml": "^5.2.3"
+    "js-yaml": "^5.4.1"
   },
   "devDependencies": {
     "@rnx-kit/scripts": "*",
diff --git a/packages/align-deps/package.json b/packages/align-deps/package.json
index d3472dd16..c6ddb4816 100644
--- a/packages/align-deps/package.json
+++ b/packages/align-deps/package.json
@@ -61,7 +61,7 @@
     "@types/semver": "^7.0.0",
     "@types/yargs": "^17.0.0",
     "detect-indent": "^6.0.0",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "markdown-table": "^3.0.0",
     "package-json": "^10.0.0",
     "prompts": "^2.4.0",
diff --git a/packages/tools-workspaces/package.json b/packages/tools-workspaces/package.json
index ab4285c3e..45d434523 100644
--- a/packages/tools-workspaces/package.json
+++ b/packages/tools-workspaces/package.json
@@ -38,7 +38,7 @@
   "dependencies": {
     "fast-glob": "^3.2.7",
     "find-up": "^5.0.0",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "micromatch": "^4.0.0",
     "strip-json-comments": "^3.1.1"
   },
diff --git a/yarn.lock b/yarn.lock
index 963ab1196..82b0ef98a 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -4972,7 +4972,7 @@ __metadata:
     "@types/semver": "npm:^7.0.0"
     "@types/yargs": "npm:^17.0.0"
     detect-indent: "npm:^6.0.0"
-    js-yaml: "npm:^5.2.3"
+    js-yaml: "npm:^5.4.1"
     markdown-table: "npm:^3.0.0"
     oxc-resolver: "npm:^11.0.0"
     package-json: "npm:^10.0.0"
@@ -5287,7 +5287,7 @@ __metadata:
     "@rnx-kit/tools-workspaces": "npm:^0.2.6"
     "@rnx-kit/tsconfig": "npm:*"
     "@rnx-kit/types-kit-config": "npm:^2.0.0"
-    js-yaml: "npm:^5.2.3"
+    js-yaml: "npm:^5.4.1"
   bin:
     lint-lockfile: lib/cli.js
   languageName: unknown
@@ -6026,7 +6026,7 @@ __metadata:
     "@types/node": "npm:^24.0.0"
     fast-glob: "npm:^3.2.7"
     find-up: "npm:^5.0.0"
-    js-yaml: "npm:^5.2.3"
+    js-yaml: "npm:^5.4.1"
     micromatch: "npm:^4.0.0"
     strip-json-comments: "npm:^3.1.1"
   languageName: unknown
@@ -12372,14 +12372,14 @@ __metadata:
   languageName: node
   linkType: hard
 
-"js-yaml@npm:^5.2.3":
-  version: 5.2.3
-  resolution: "js-yaml@npm:5.2.3"
+"js-yaml@npm:^5.4.1":
+  version: 5.4.1
+  resolution: "js-yaml@npm:5.4.1"
   dependencies:
     argparse: "npm:^2.0.1"
   bin:
     js-yaml: bin/js-yaml.mjs
-  checksum: 10c0/55cd6310c8eee88d432ae038d451ac9d6aa0eb9e5d38a94df3d6c4a4015d08c9dad7c18669e0e8854e4173a615d6b6b7448bd0aac408773f8a46122ffd863c69
+  checksum: 10c0/efe9dfaf222809694d375ad5ecca825561d2432eb55bc0f628911c0dfa4dbce98a71dcbc3252f630208bbdf5f4e9ac363847e4a7f49845b577ae2548b8fcf147
   languageName: node
   linkType: hard