diff --git a/package-lock.json b/package-lock.json
index 45df1ecf..8cf27b1d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -18,7 +18,7 @@
         "@defra/hapi-secure-context": "^0.3.0",
         "@elastic/ecs-winston-format": "^1.5.3",
         "@graphql-tools/load-files": "^7.0.1",
-        "@graphql-tools/merge": "^9.0.17",
+        "@graphql-tools/merge": "^9.1.9",
         "@graphql-tools/schema": "^10.0.16",
         "@graphql-tools/utils": "^10.7.2",
         "@hapi/hapi": "^21.3.12",
@@ -2207,12 +2207,30 @@
       }
     },
     "node_modules/@graphql-tools/merge": {
-      "version": "9.1.6",
-      "resolved": "https://registry.npmjs.org/@graphql-tools/merge/-/merge-9.1.6.tgz",
-      "integrity": "sha512-bTnP+4oom4nDjmkS3Ykbe+ljAp/RIiWP3R35COMmuucS24iQxGLa9Hn8VMkLIoaoPxgz6xk+dbC43jtkNsFoBw==",
+      "version": "9.1.9",
+      "resolved": "https://registry.npmjs.org/@graphql-tools/merge/-/merge-9.1.9.tgz",
+      "integrity": "sha512-iHUWNjRHeQRYdgIMIuChThOwoKzA9vrzYeslgfBo5eUYEyHGZCoDPjAavssoYXLwstYt1dZj2J22jSzc2DrN0Q==",
       "license": "MIT",
       "dependencies": {
-        "@graphql-tools/utils": "^10.11.0",
+        "@graphql-tools/utils": "^11.1.0",
+        "tslib": "^2.4.0"
+      },
+      "engines": {
+        "node": ">=16.0.0"
+      },
+      "peerDependencies": {
+        "graphql": "^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0"
+      }
+    },
+    "node_modules/@graphql-tools/merge/node_modules/@graphql-tools/utils": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/@graphql-tools/utils/-/utils-11.1.0.tgz",
+      "integrity": "sha512-PtFVG4r8Z2LEBSaPYQMusBiB3o6kjLVJyjCLbnWem/SpSuM21v6LTmgpkXfYU1qpBV2UGsFyuEnSJInl8fR1Ag==",
+      "license": "MIT",
+      "dependencies": {
+        "@graphql-typed-document-node/core": "^3.1.1",
+        "@whatwg-node/promise-helpers": "^1.0.0",
+        "cross-inspect": "1.0.1",
         "tslib": "^2.4.0"
       },
       "engines": {
diff --git a/package.json b/package.json
index cd7d9a77..f40bb519 100644
--- a/package.json
+++ b/package.json
@@ -41,7 +41,7 @@
     "@defra/hapi-secure-context": "^0.3.0",
     "@elastic/ecs-winston-format": "^1.5.3",
     "@graphql-tools/load-files": "^7.0.1",
-    "@graphql-tools/merge": "^9.0.17",
+    "@graphql-tools/merge": "^9.1.9",
     "@graphql-tools/schema": "^10.0.16",
     "@graphql-tools/utils": "^10.7.2",
     "@hapi/hapi": "^21.3.12",