diff --git a/MODULE.bazel b/MODULE.bazel
index 63184106..3d96f13a 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -39,7 +39,7 @@ local_path_override(
     path = "modules/c",
 )
 
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 
 # C++
 bazel_dep(name = "rules_proto_grpc_cpp", version = "0.0.0.rpg.version.placeholder")
@@ -48,7 +48,7 @@ local_path_override(
     path = "modules/cpp",
 )
 
-bazel_dep(name = "toolchains_protoc", version = "0.3.1")
+bazel_dep(name = "toolchains_protoc", version = "0.3.4")
 
 # Prevent version skew by matching protoc version to protobuf version, as C++ is the only lang that
 # has no cross-version runtime guarantee:
diff --git a/modules/c/MODULE.bazel b/modules/c/MODULE.bazel
index 0e11a262..2a2036f8 100644
--- a/modules/c/MODULE.bazel
+++ b/modules/c/MODULE.bazel
@@ -4,6 +4,6 @@ module(
     compatibility_level = 1,
 )
 
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "rules_proto_grpc", version = "0.0.0.rpg.version.placeholder")
diff --git a/modules/core/MODULE.bazel b/modules/core/MODULE.bazel
index ff27d8cf..e7d0cb63 100644
--- a/modules/core/MODULE.bazel
+++ b/modules/core/MODULE.bazel
@@ -7,4 +7,4 @@ module(
 bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "rules_cc", version = "0.0.13")  # For fixer
 bazel_dep(name = "rules_proto", version = "6.0.2")
-bazel_dep(name = "toolchains_protoc", version = "0.3.1")
+bazel_dep(name = "toolchains_protoc", version = "0.3.4")
diff --git a/modules/cpp/MODULE.bazel b/modules/cpp/MODULE.bazel
index 33ddbcc6..def7e6af 100644
--- a/modules/cpp/MODULE.bazel
+++ b/modules/cpp/MODULE.bazel
@@ -5,6 +5,6 @@ module(
 )
 
 bazel_dep(name = "grpc", version = "1.65.0")
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "rules_proto_grpc", version = "0.0.0.rpg.version.placeholder")
diff --git a/modules/example_protos/MODULE.bazel b/modules/example_protos/MODULE.bazel
index ee653d26..48533ccc 100644
--- a/modules/example_protos/MODULE.bazel
+++ b/modules/example_protos/MODULE.bazel
@@ -4,5 +4,5 @@ module(
     compatibility_level = 1,
 )
 
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_proto", version = "6.0.2")
diff --git a/modules/objc/MODULE.bazel b/modules/objc/MODULE.bazel
index b3787ea6..d87d5d88 100644
--- a/modules/objc/MODULE.bazel
+++ b/modules/objc/MODULE.bazel
@@ -6,6 +6,6 @@ module(
 
 bazel_dep(name = "apple_support", version = "1.17.1")
 bazel_dep(name = "grpc", version = "1.65.0")
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "rules_proto_grpc", version = "0.0.0.rpg.version.placeholder")
diff --git a/modules/python/requirements.in b/modules/python/requirements.in
index 04c2a284..c2766488 100644
--- a/modules/python/requirements.in
+++ b/modules/python/requirements.in
@@ -1,3 +1,3 @@
 grpcio==1.65.4  # TODO: remove once pulling grpc from BCR @grpc works
 grpclib==0.4.7
-protobuf==5.27.2
+protobuf==5.28.3
diff --git a/modules/python/requirements.txt b/modules/python/requirements.txt
index 3914eda9..cd89a865 100644
--- a/modules/python/requirements.txt
+++ b/modules/python/requirements.txt
@@ -161,16 +161,16 @@ multidict==6.1.0 \
     --hash=sha256:f90c822a402cb865e396a504f9fc8173ef34212a342d92e362ca498cad308e28 \
     --hash=sha256:ff3827aef427c89a25cc96ded1759271a93603aba9fb977a6d264648ebf989db
     # via grpclib
-protobuf==5.27.2 \
-    --hash=sha256:0e341109c609749d501986b835f667c6e1e24531096cff9d34ae411595e26505 \
-    --hash=sha256:176c12b1f1c880bf7a76d9f7c75822b6a2bc3db2d28baa4d300e8ce4cde7409b \
-    --hash=sha256:354d84fac2b0d76062e9b3221f4abbbacdfd2a4d8af36bab0474f3a0bb30ab38 \
-    --hash=sha256:4fadd8d83e1992eed0248bc50a4a6361dc31bcccc84388c54c86e530b7f58863 \
-    --hash=sha256:54330f07e4949d09614707c48b06d1a22f8ffb5763c159efd5c0928326a91470 \
-    --hash=sha256:610e700f02469c4a997e58e328cac6f305f649826853813177e6290416e846c6 \
-    --hash=sha256:7fc3add9e6003e026da5fc9e59b131b8f22b428b991ccd53e2af8071687b4fce \
-    --hash=sha256:9e8f199bf7f97bd7ecebffcae45ebf9527603549b2b562df0fbc6d4d688f14ca \
-    --hash=sha256:a109916aaac42bff84702fb5187f3edadbc7c97fc2c99c5ff81dd15dcce0d1e5 \
-    --hash=sha256:b848dbe1d57ed7c191dfc4ea64b8b004a3f9ece4bf4d0d80a367b76df20bf36e \
-    --hash=sha256:f3ecdef226b9af856075f28227ff2c90ce3a594d092c39bee5513573f25e2714
+protobuf==5.28.3 \
+    --hash=sha256:0c4eec6f987338617072592b97943fdbe30d019c56126493111cf24344c1cc24 \
+    --hash=sha256:135658402f71bbd49500322c0f736145731b16fc79dc8f367ab544a17eab4535 \
+    --hash=sha256:27b246b3723692bf1068d5734ddaf2fccc2cdd6e0c9b47fe099244d80200593b \
+    --hash=sha256:3e6101d095dfd119513cde7259aa703d16c6bbdfae2554dfe5cfdbe94e32d548 \
+    --hash=sha256:3fa2de6b8b29d12c61911505d893afe7320ce7ccba4df913e2971461fa36d584 \
+    --hash=sha256:64badbc49180a5e401f373f9ce7ab1d18b63f7dd4a9cdc43c92b9f0b481cef7b \
+    --hash=sha256:70585a70fc2dd4818c51287ceef5bdba6387f88a578c86d47bb34669b5552c36 \
+    --hash=sha256:712319fbdddb46f21abb66cd33cb9e491a5763b2febd8f228251add221981135 \
+    --hash=sha256:91fba8f445723fcf400fdbe9ca796b19d3b1242cd873907979b9ed71e4afe868 \
+    --hash=sha256:a3f6857551e53ce35e60b403b8a27b0295f7d6eb63d10484f12bc6879c715687 \
+    --hash=sha256:cee1757663fa32a1ee673434fcf3bf24dd54763c79690201208bafec62f19eed
     # via -r requirements.in
diff --git a/test_workspaces/common_cpp_library/MODULE.bazel b/test_workspaces/common_cpp_library/MODULE.bazel
index 5e801da3..64f4d78f 100644
--- a/test_workspaces/common_cpp_library/MODULE.bazel
+++ b/test_workspaces/common_cpp_library/MODULE.bazel
@@ -1,4 +1,4 @@
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_cc", version = "0.0.13")
 bazel_dep(name = "rules_proto", version = "6.0.2")
 bazel_dep(name = "rules_proto_grpc_cpp", version = "0.0.0.rpg.version.placeholder")
diff --git a/test_workspaces/exclusions/MODULE.bazel b/test_workspaces/exclusions/MODULE.bazel
index dda26679..3c46cdb3 100644
--- a/test_workspaces/exclusions/MODULE.bazel
+++ b/test_workspaces/exclusions/MODULE.bazel
@@ -1,4 +1,4 @@
-bazel_dep(name = "protobuf", version = "27.1")
+bazel_dep(name = "protobuf", version = "27.5")
 bazel_dep(name = "rules_proto", version = "6.0.2")
 bazel_dep(name = "rules_proto_grpc_python", version = "0.0.0.rpg.version.placeholder")
 bazel_dep(name = "rules_python", version = "0.37.2")