diff --git a/packages/mcp/CHANGELOG.md b/packages/mcp/CHANGELOG.md
index 5a222c77c..0e10aed20 100644
--- a/packages/mcp/CHANGELOG.md
+++ b/packages/mcp/CHANGELOG.md
@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 - Bumped `@modelcontextprotocol/sdk` from 1.10.2 to 1.26.0. [#958](https://github.com/sourcebot-dev/sourcebot/pull/958)
+- Bumped `zod` from `^3.24.3` to `^4.3.6`. [#964](https://github.com/sourcebot-dev/sourcebot/pull/964)
 
 ## [1.0.17] - 2026-02-19
 
diff --git a/packages/mcp/package.json b/packages/mcp/package.json
index 2d58c8a53..65f68506d 100644
--- a/packages/mcp/package.json
+++ b/packages/mcp/package.json
@@ -22,7 +22,7 @@
         "dedent": "^1.7.1",
         "escape-string-regexp": "^5.0.0",
         "express": "^5.1.0",
-        "zod": "^3.24.3"
+        "zod": "^4.3.6"
     },
     "bin": {
         "sourcebot-mcp": "./dist/index.js"
diff --git a/yarn.lock b/yarn.lock
index a59f31dc8..e2645ebb8 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8539,7 +8539,7 @@ __metadata:
     tsc-watch: "npm:6.2.1"
     tsx: "npm:^4.0.0"
     typescript: "npm:^5.0.0"
-    zod: "npm:^3.24.3"
+    zod: "npm:^4.3.6"
   bin:
     sourcebot-mcp: ./dist/index.js
   languageName: unknown
@@ -22252,14 +22252,7 @@ __metadata:
   languageName: node
   linkType: hard
 
-"zod@npm:^3.24.3":
-  version: 3.24.3
-  resolution: "zod@npm:3.24.3"
-  checksum: 10c0/ab0369810968d0329a1a141e9418e01e5c9c2a4905cbb7cb7f5a131d6e9487596e1400e21eeff24c4a8ee28dacfa5bd6103893765c055b7a98c2006a5a4fc68d
-  languageName: node
-  linkType: hard
-
-"zod@npm:^3.25 || ^4.0, zod@npm:^3.25.76 || ^4, zod@npm:^4.1.13":
+"zod@npm:^3.25 || ^4.0, zod@npm:^3.25.76 || ^4, zod@npm:^4.1.13, zod@npm:^4.3.6":
   version: 4.3.6
   resolution: "zod@npm:4.3.6"
   checksum: 10c0/860d25a81ab41d33aa25f8d0d07b091a04acb426e605f396227a796e9e800c44723ed96d0f53a512b57be3d1520f45bf69c0cb3b378a232a00787a2609625307