diff --git a/.github/workflows/gating.yaml b/.github/workflows/gating.yaml
index 70f4138..6ec0194 100644
--- a/.github/workflows/gating.yaml
+++ b/.github/workflows/gating.yaml
@@ -16,12 +16,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
           python-version: "3.12"
 
       - name: Install system dependencies
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2
+        uses: nick-invision/retry@7152eba30c6575329ac0576536151aca5a72780e # v3
         with:
           timeout_minutes: 10
           retry_wait_seconds: 30
@@ -78,7 +78,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
           python-version: "3.12"
 
@@ -122,12 +122,12 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: Set up Python
-        uses: actions/setup-python@65d7f2d534ac1bc67fcd62888c5f4f3d2cb2b236 # v4
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
           python-version: "3.12"
 
       - name: Install system dependencies
-        uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # v2
+        uses: nick-invision/retry@7152eba30c6575329ac0576536151aca5a72780e # v3
         with:
           timeout_minutes: 10
           retry_wait_seconds: 30
diff --git a/Dockerfile b/Dockerfile
index 31d552a..a960b98 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM quay.io/fedora/python-312:20241120@sha256:aedc5b00a981c671a5dab3c1885f89398b2bf633264542635e3fc3096a56538a AS builder
+FROM quay.io/fedora/python-312:20250101@sha256:30e9dd44032e041c4967ec7d20f35929e6c5de30cd6afe0f575f9786e9c90723 AS builder
 
 # builder should use root to install/create all files
 USER root
diff --git a/docker-compose.yml b/docker-compose.yml
index a4f258a..7db4802 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -30,7 +30,7 @@ services:
       retries: 30
 
   waiverdb-db:
-    image: postgres:14.7-alpine@sha256:07985c5c5e01ee550b30c67a2cf806f8b08b32f74e3f24c4cbef31305ef5776d
+    image: postgres:17.2-alpine@sha256:d37d2c160d34430877c802e5adc22824a2ad453499db9bab1a2ceb2be6c1a46f
     restart: always
     env_file: ["docker/waiverdb-db.env"]
     healthcheck:
@@ -38,7 +38,7 @@ services:
       test: "pg_isready -U postgres"
 
   keycloak:
-    image: quay.io/keycloak/keycloak:24.0.2@sha256:b8a3f00fc433f2999bc304b73df331e2005037e8f5673f644f9c0eacd5fbe048
+    image: quay.io/keycloak/keycloak:26.0.7@sha256:4388e2379b7e870a447adbe7b80bd61f5fbf04e925832b19669fda4957f05a81
     ports:
       - 127.0.0.1:5004:5004
       - 127.0.0.1:8080:8080
diff --git a/pyproject.toml b/pyproject.toml
index 4c8566d..2c9d218 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -36,7 +36,7 @@ include = [
 ]
 
 [tool.poetry.dependencies]
-python = ">=3.9,<3.13"
+python = ">=3.13,<3.14"
 
 # https://github.com/lepture/authlib/pull/662
 # fix authlib to use correct auth method for token introspection
@@ -76,7 +76,7 @@ fedora-messaging = "^3.4.1"
 
 # Tests
 pytest = {version = "^8.3.3", optional = true}
-pytest-cov = {version = "^5.0.0", optional = true}
+pytest-cov = {version = "^6.0.0", optional = true}
 mock = {version = "^5.1.0", optional = true}
 
 # Functional Tests
@@ -90,9 +90,9 @@ opentelemetry-instrumentation-flask = "^0.46b0"
 opentelemetry-instrumentation-sqlalchemy = "^0.46b0"
 
 # Documentation
-sphinx = {version = "^7.1.1", optional = true}
+sphinx = {version = "^8.0.0", optional = true}
 sphinxcontrib-httpdomain = {version = "^1.8.1", optional = true}
-markupsafe = {version = "==2.1.5", optional = true}
+markupsafe = {version = "==3.0.2", optional = true}
 pydantic = "^2.9.2"
 Flask-Pydantic = "^0.12.0"
 flask-restx = "^1.3.0"