diff --git a/e2e/package-lock.json b/e2e/package-lock.json
index cbd2681..d9f905d 100644
--- a/e2e/package-lock.json
+++ b/e2e/package-lock.json
@@ -7,7 +7,7 @@
       "name": "zero-server-e2e",
       "dependencies": {
         "@rocicorp/zero": "1.10.0",
-        "postgres": "3.4.7"
+        "postgres": "3.4.9"
       }
     },
     "node_modules/@badrap/valita": {
@@ -2947,6 +2947,19 @@
         "node": "22.x || 24.x"
       }
     },
+    "node_modules/@rocicorp/zero/node_modules/postgres": {
+      "version": "3.4.7",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
+      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
+      "license": "Unlicense",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://github.com/sponsors/porsager"
+      }
+    },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
@@ -5175,9 +5188,9 @@
       }
     },
     "node_modules/postgres": {
-      "version": "3.4.7",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
-      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
+      "version": "3.4.9",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.9.tgz",
+      "integrity": "sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==",
       "license": "Unlicense",
       "engines": {
         "node": ">=12"
diff --git a/e2e/package.json b/e2e/package.json
index e26a227..b5dc967 100644
--- a/e2e/package.json
+++ b/e2e/package.json
@@ -4,6 +4,6 @@
   "type": "module",
   "dependencies": {
     "@rocicorp/zero": "1.10.0",
-    "postgres": "3.4.7"
+    "postgres": "3.4.9"
   }
 }
diff --git a/harness/package-lock.json b/harness/package-lock.json
index 2a890e4..5fc296a 100644
--- a/harness/package-lock.json
+++ b/harness/package-lock.json
@@ -7,7 +7,7 @@
       "name": "zero-server-harness",
       "dependencies": {
         "@rocicorp/zero": "1.10.0",
-        "postgres": "3.4.7"
+        "postgres": "3.4.9"
       }
     },
     "node_modules/@badrap/valita": {
@@ -2947,6 +2947,19 @@
         "node": "22.x || 24.x"
       }
     },
+    "node_modules/@rocicorp/zero/node_modules/postgres": {
+      "version": "3.4.7",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
+      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
+      "license": "Unlicense",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "type": "individual",
+        "url": "https://github.com/sponsors/porsager"
+      }
+    },
     "node_modules/@standard-schema/spec": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@standard-schema/spec/-/spec-1.1.0.tgz",
@@ -5175,9 +5188,9 @@
       }
     },
     "node_modules/postgres": {
-      "version": "3.4.7",
-      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.7.tgz",
-      "integrity": "sha512-Jtc2612XINuBjIl/QTWsV5UvE8UHuNblcO3vVADSrKsrc6RqGX6lOW1cEo3CM2v0XG4Nat8nI+YM7/f26VxXLw==",
+      "version": "3.4.9",
+      "resolved": "https://registry.npmjs.org/postgres/-/postgres-3.4.9.tgz",
+      "integrity": "sha512-GD3qdB0x1z9xgFI6cdRD6xu2Sp2WCOEoe3mtnyB5Ee0XrrL5Pe+e4CCnJrRMnL1zYtRDZmQQVbvOttLnKDLnaw==",
       "license": "Unlicense",
       "engines": {
         "node": ">=12"
diff --git a/harness/package.json b/harness/package.json
index f23a14a..f0a2796 100644
--- a/harness/package.json
+++ b/harness/package.json
@@ -4,6 +4,6 @@
   "type": "module",
   "dependencies": {
     "@rocicorp/zero": "1.10.0",
-    "postgres": "3.4.7"
+    "postgres": "3.4.9"
   }
 }