diff --git a/sigstore-java/build.gradle.kts b/sigstore-java/build.gradle.kts
index 369194d15..18ad7558f 100644
--- a/sigstore-java/build.gradle.kts
+++ b/sigstore-java/build.gradle.kts
@@ -35,7 +35,7 @@ dependencies {
     compileOnly("org.apache.tomcat:annotations-api:6.0.53") // java 9+ only
 
     implementation("commons-codec:commons-codec:1.18.0")
-    implementation("com.google.code.gson:gson:2.13.2")
+    implementation("com.google.code.gson:gson:2.14.0")
     implementation("org.bouncycastle:bcutil-jdk18on:1.84")
     implementation("org.bouncycastle:bcpkix-jdk18on:1.84")
 
diff --git a/sigstore-testkit/build.gradle.kts b/sigstore-testkit/build.gradle.kts
index 0abc29903..6cb7a6d03 100644
--- a/sigstore-testkit/build.gradle.kts
+++ b/sigstore-testkit/build.gradle.kts
@@ -6,7 +6,7 @@ plugins {
 
 dependencies {
     implementation(project(":sigstore-java"))
-    implementation("com.google.code.gson:gson:2.13.2")
+    implementation("com.google.code.gson:gson:2.14.0")
     implementation("com.google.guava:guava:33.5.0-jre")
 
     // This is different from typical "testImplementation" dependencies, because