diff --git a/images/hub/requirements.txt b/images/hub/requirements.txt
index e8cea6ff88..defa01634a 100644
--- a/images/hub/requirements.txt
+++ b/images/hub/requirements.txt
@@ -6,11 +6,11 @@
 #
 aiohappyeyeballs==2.6.1
     # via aiohttp
-aiohttp==3.11.18
+aiohttp==3.12.1
     # via kubernetes-asyncio
 aiosignal==1.3.2
     # via aiohttp
-alembic==1.15.2
+alembic==1.16.1
     # via jupyterhub
 annotated-types==0.7.0
     # via pydantic
@@ -37,7 +37,7 @@ cffi==1.17.1
     # via cryptography
 charset-normalizer==3.4.2
     # via requests
-cryptography==45.0.2
+cryptography==45.0.3
     # via
     #   certipy
     #   pyjwt
@@ -51,7 +51,7 @@ frozenlist==1.6.0
     # via
     #   aiohttp
     #   aiosignal
-google-auth==2.40.1
+google-auth==2.40.2
     # via google-auth-oauthlib
 google-auth-oauthlib==1.2.2
     # via oauthenticator
@@ -71,7 +71,7 @@ jinja2==3.1.6
     #   jupyterhub-kubespawner
 jsonpointer==3.0.0
     # via jsonschema
-jsonschema==4.23.0
+jsonschema==4.24.0
     # via
     #   jupyter-events
     #   oauthenticator
@@ -114,7 +114,7 @@ markupsafe==3.0.2
     # via
     #   jinja2
     #   mako
-multidict==6.4.3
+multidict==6.4.4
     # via
     #   aiohttp
     #   yarl
@@ -156,7 +156,7 @@ pycparser==2.22
     # via cffi
 pycurl==7.45.6
     # via -r unfrozen/requirements.txt
-pydantic==2.11.4
+pydantic==2.11.5
     # via jupyterhub
 pydantic-core==2.33.2
     # via pydantic
@@ -205,13 +205,13 @@ rfc3986-validator==0.1.1
     # via
     #   jsonschema
     #   jupyter-events
-rpds-py==0.25.0
+rpds-py==0.25.1
     # via
     #   jsonschema
     #   referencing
 rsa==4.9.1
     # via google-auth
-ruamel-yaml==0.18.10
+ruamel-yaml==0.18.11
     # via oauthenticator
 ruamel-yaml-clib==0.2.12
     # via ruamel-yaml
@@ -232,7 +232,7 @@ statsd==4.0.1
     # via -r unfrozen/requirements.txt
 text-unidecode==1.3
     # via python-slugify
-tornado==6.5
+tornado==6.5.1
     # via
     #   jupyterhub
     #   jupyterhub-idle-culler
@@ -255,7 +255,7 @@ typing-extensions==4.13.2
     #   referencing
     #   sqlalchemy
     #   typing-inspection
-typing-inspection==0.4.0
+typing-inspection==0.4.1
     # via pydantic
 uri-template==1.3.0
     # via jsonschema
diff --git a/images/singleuser-sample/requirements.txt b/images/singleuser-sample/requirements.txt
index 41a0e0f925..ae96a25b85 100644
--- a/images/singleuser-sample/requirements.txt
+++ b/images/singleuser-sample/requirements.txt
@@ -4,7 +4,7 @@
 #
 #    Use the "Run workflow" button at https://github.com/jupyterhub/zero-to-jupyterhub-k8s/actions/workflows/watch-dependencies.yaml
 #
-alembic==1.15.2
+alembic==1.16.1
     # via jupyterhub
 annotated-types==0.7.0
     # via pydantic
@@ -47,7 +47,7 @@ charset-normalizer==3.4.2
     # via requests
 comm==0.2.2
     # via ipykernel
-cryptography==45.0.2
+cryptography==45.0.3
     # via certipy
 debugpy==1.8.14
     # via ipykernel
@@ -101,7 +101,7 @@ json5==0.12.0
     # via jupyterlab-server
 jsonpointer==3.0.0
     # via jsonschema
-jsonschema==4.23.0
+jsonschema==4.24.0
     # via
     #   jupyter-events
     #   jupyterlab-server
@@ -113,7 +113,7 @@ jupyter-client==8.6.3
     #   ipykernel
     #   jupyter-server
     #   nbclient
-jupyter-core==5.7.2
+jupyter-core==5.8.0
     # via
     #   ipykernel
     #   jupyter-client
@@ -139,7 +139,7 @@ jupyter-server-terminals==0.5.3
     # via jupyter-server
 jupyterhub==5.3.0
     # via -r unfrozen/requirements.txt
-jupyterlab==4.4.2
+jupyterlab==4.4.3
     # via -r unfrozen/requirements.txt
 jupyterlab-pygments==0.3.0
     # via nbconvert
@@ -218,7 +218,7 @@ pure-eval==0.2.3
     # via stack-data
 pycparser==2.22
     # via cffi
-pydantic==2.11.4
+pydantic==2.11.5
     # via jupyterhub
 pydantic-core==2.33.2
     # via pydantic
@@ -258,7 +258,7 @@ rfc3986-validator==0.1.1
     # via
     #   jsonschema
     #   jupyter-events
-rpds-py==0.25.0
+rpds-py==0.25.1
     # via
     #   jsonschema
     #   referencing
@@ -284,7 +284,7 @@ terminado==0.18.1
     #   jupyter-server-terminals
 tinycss2==1.4.0
     # via bleach
-tornado==6.5
+tornado==6.5.1
     # via
     #   ipykernel
     #   jupyter-client
@@ -320,7 +320,7 @@ typing-extensions==4.13.2
     #   referencing
     #   sqlalchemy
     #   typing-inspection
-typing-inspection==0.4.0
+typing-inspection==0.4.1
     # via pydantic
 uri-template==1.3.0
     # via jsonschema
@@ -338,5 +338,5 @@ websocket-client==1.8.0
     # via jupyter-server
 
 # The following packages are considered to be unsafe in a requirements file:
-setuptools==80.7.1
+setuptools==80.8.0
     # via jupyterlab