diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c634fb6bee..b4adc295a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ jobs:
 
     services:
       db:
-        image: postgres:17.7
+        image: postgres:18.1
         # Health checks to wait until postgres has started
         options: >-
           --health-cmd pg_isready
@@ -26,7 +26,7 @@ jobs:
           - 6379:6379
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Apt update
         run: sudo apt-get update -y
@@ -118,7 +118,7 @@ jobs:
   javascript-tests:
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup NodeJS
         uses: actions/setup-node@v2-beta
diff --git a/.github/workflows/production.yml b/.github/workflows/production.yml
index 244fbd2dc4..5e1ceaa6cb 100644
--- a/.github/workflows/production.yml
+++ b/.github/workflows/production.yml
@@ -15,7 +15,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: release
       - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28
diff --git a/.github/workflows/release-candiate.yml b/.github/workflows/release-candiate.yml
index 8a2e62ae8f..59c07150b7 100644
--- a/.github/workflows/release-candiate.yml
+++ b/.github/workflows/release-candiate.yml
@@ -15,7 +15,7 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       github.event.workflow_run.conclusion == 'success'
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: release-candidate
       - uses: akhileshns/heroku-deploy@e3eb99d45a8e2ec5dca08735e089607befa4bf28
diff --git a/RELEASE.rst b/RELEASE.rst
index 07a0b422ef..48f9a75bac 100644
--- a/RELEASE.rst
+++ b/RELEASE.rst
@@ -1,6 +1,18 @@
 Release Notes
 =============
 
+Version 0.191.1
+---------------
+
+- chore(deps): update dependency faker to v40.4.0 (#3784)
+- chore(deps): update actions/checkout digest to de0fac2 (#3781)
+- chore(deps): update nginx docker tag to v1.29.5 (#3782)
+- fix(deps): update dependency boto3 to v1.42.44 (#3783)
+- chore(deps): update postgres docker tag to v18 (#3772)
+- fix(deps): update dependency django to v4.2.28 [security] (#3778)
+- fix(deps): update dependency google-api-python-client to v2.188.0 (#3775)
+- fix(deps): update dependency boto3 to v1.42.40 (#3774)
+
 Version 0.191.0 (Released February 09, 2026)
 ---------------
 
diff --git a/docker-compose.yml b/docker-compose.yml
index bd876cc0fb..57535c58b8 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -20,7 +20,7 @@ x-extra-hosts: &default-extra-hosts
 
 services:
   db:
-    image: postgres:17.7
+    image: postgres:18.1
     environment:
       POSTGRES_PASSWORD: postgres # pragma: allowlist secret
     ports:
@@ -32,7 +32,7 @@ services:
       - "6379"
 
   nginx:
-    image: nginx:1.29.4
+    image: nginx:1.29.5
     ports:
       - "8053:8053"
     links:
diff --git a/mitxpro/settings.py b/mitxpro/settings.py
index 10bce297b5..5526d5b627 100644
--- a/mitxpro/settings.py
+++ b/mitxpro/settings.py
@@ -26,7 +26,7 @@
 from mitxpro.celery_utils import OffsettingSchedule
 from mitxpro.sentry import init_sentry
 
-VERSION = "0.191.0"
+VERSION = "0.191.1"
 
 env.reset()
 
diff --git a/poetry.lock b/poetry.lock
index c2738a8ead..cdee6e8a65 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -203,18 +203,18 @@ files = [
 
 [[package]]
 name = "boto3"
-version = "1.42.39"
+version = "1.42.44"
 description = "The AWS SDK for Python"
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "boto3-1.42.39-py3-none-any.whl", hash = "sha256:d9d6ce11df309707b490d2f5f785b761cfddfd6d1f665385b78c9d8ed097184b"},
-    {file = "boto3-1.42.39.tar.gz", hash = "sha256:d03f82363314759eff7f84a27b9e6428125f89d8119e4588e8c2c1d79892c956"},
+    {file = "boto3-1.42.44-py3-none-any.whl", hash = "sha256:32e995b0d56e19422cff22f586f698e8924c792eb00943de9c517ff4607e4e18"},
+    {file = "boto3-1.42.44.tar.gz", hash = "sha256:d5601ea520d30674c1d15791a1f98b5c055e973c775e1d9952ccc09ee5913c4e"},
 ]
 
 [package.dependencies]
-botocore = ">=1.42.39,<1.43.0"
+botocore = ">=1.42.44,<1.43.0"
 jmespath = ">=0.7.1,<2.0.0"
 s3transfer = ">=0.16.0,<0.17.0"
 
@@ -223,14 +223,14 @@ crt = ["botocore[crt] (>=1.21.0,<2.0a0)"]
 
 [[package]]
 name = "botocore"
-version = "1.42.39"
+version = "1.42.44"
 description = "Low-level, data-driven core of boto 3."
 optional = false
 python-versions = ">=3.9"
 groups = ["main"]
 files = [
-    {file = "botocore-1.42.39-py3-none-any.whl", hash = "sha256:9e0d0fed9226449cc26fcf2bbffc0392ac698dd8378e8395ce54f3ec13f81d58"},
-    {file = "botocore-1.42.39.tar.gz", hash = "sha256:0f00355050821e91a5fe6d932f7bf220f337249b752899e3e4cf6ed54326249e"},
+    {file = "botocore-1.42.44-py3-none-any.whl", hash = "sha256:ba406b9243a20591ee87d53abdb883d46416705cebccb639a7f1c923f9dd82df"},
+    {file = "botocore-1.42.44.tar.gz", hash = "sha256:47ba27360f2afd2c2721545d8909217f7be05fdee16dd8fc0b09589535a0701c"},
 ]
 
 [package.dependencies]
@@ -1008,14 +1008,14 @@ django = ">=4.2"
 
 [[package]]
 name = "django"
-version = "4.2.27"
+version = "4.2.28"
 description = "A high-level Python web framework that encourages rapid development and clean, pragmatic design."
 optional = false
 python-versions = ">=3.8"
 groups = ["main", "dev"]
 files = [
-    {file = "django-4.2.27-py3-none-any.whl", hash = "sha256:f393a394053713e7d213984555c5b7d3caeee78b2ccb729888a0774dff6c11a8"},
-    {file = "django-4.2.27.tar.gz", hash = "sha256:b865fbe0f4a3d1ee36594c5efa42b20db3c8bbb10dff0736face1c6e4bda5b92"},
+    {file = "django-4.2.28-py3-none-any.whl", hash = "sha256:49a23c1b83ef31525f8d71a57b040f91d34660edb3f086280a8519855655ed3c"},
+    {file = "django-4.2.28.tar.gz", hash = "sha256:a4b9cd881991add394cafa8bb3b11ad1742d1e1470ba99c3ef53dc540316ccfe"},
 ]
 
 [package.dependencies]
@@ -1536,14 +1536,14 @@ doc = ["Sphinx", "sphinx-rtd-theme", "sphinxcontrib-spelling"]
 
 [[package]]
 name = "faker"
-version = "40.1.2"
+version = "40.4.0"
 description = "Faker is a Python package that generates fake data for you."
 optional = false
 python-versions = ">=3.10"
 groups = ["main", "dev"]
 files = [
-    {file = "faker-40.1.2-py3-none-any.whl", hash = "sha256:93503165c165d330260e4379fd6dc07c94da90c611ed3191a0174d2ab9966a42"},
-    {file = "faker-40.1.2.tar.gz", hash = "sha256:b76a68163aa5f171d260fc24827a8349bc1db672f6a665359e8d0095e8135d30"},
+    {file = "faker-40.4.0-py3-none-any.whl", hash = "sha256:486d43c67ebbb136bc932406418744f9a0bdf2c07f77703ea78b58b77e9aa443"},
+    {file = "faker-40.4.0.tar.gz", hash = "sha256:76f8e74a3df28c3e2ec2caafa956e19e37a132fdc7ea067bc41783affcfee364"},
 ]
 
 [package.dependencies]
@@ -1644,14 +1644,14 @@ grpcio-gcp = ["grpcio-gcp (>=0.2.2,<1.0dev)"]
 
 [[package]]
 name = "google-api-python-client"
-version = "2.187.0"
+version = "2.188.0"
 description = "Google API Client Library for Python"
 optional = false
 python-versions = ">=3.7"
 groups = ["main"]
 files = [
-    {file = "google_api_python_client-2.187.0-py3-none-any.whl", hash = "sha256:d8d0f6d85d7d1d10bdab32e642312ed572bdc98919f72f831b44b9a9cebba32f"},
-    {file = "google_api_python_client-2.187.0.tar.gz", hash = "sha256:e98e8e8f49e1b5048c2f8276473d6485febc76c9c47892a8b4d1afa2c9ec8278"},
+    {file = "google_api_python_client-2.188.0-py3-none-any.whl", hash = "sha256:3cad1b68f9d48b82b93d77927e8370a6f43f33d97848242601f14a93a1c70ef5"},
+    {file = "google_api_python_client-2.188.0.tar.gz", hash = "sha256:5c469db6614f071009e3e5bb8b6aeeccae3beb3647fa9c6cd97f0d551edde0b6"},
 ]
 
 [package.dependencies]
@@ -4980,4 +4980,4 @@ xmlsec = ["xmlsec (>=0.6.1)"]
 [metadata]
 lock-version = "2.1"
 python-versions = "^3.13"
-content-hash = "114593574e37bb76af937bcfe8fde7a2d04a22a96925613836def79f4a9f410c"
+content-hash = "bbcc86421d6fd6f6b018c91bc9135e8cb9845acee8b80ac454249569109fc0e5"
diff --git a/pyproject.toml b/pyproject.toml
index 174d2973f3..26c3589436 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -15,11 +15,11 @@ python = "^3.13"
 Pillow = "10.4.0"
 PyNaCl = "1.6.2"
 beautifulsoup4 = "4.8.2"
-boto3 = "1.42.39"
+boto3 = "1.42.44"
 celery = "5.6.2"
 celery-redbeat = "2.3.3"
 dj-database-url = "3.1.0"
-django = "4.2.27"
+django = "4.2.28"
 django-anymail = { version = "13.1", extras = ["mailgun"] }
 django-filter = "^23.4"
 django-hijack = "3.7.6"
@@ -34,7 +34,7 @@ django-webpack-loader = "1.8.1"
 djangorestframework = "3.16.1"
 edx-api-client = "1.14.0"
 flaky = "3.8.1"
-google-api-python-client = "2.187.0"
+google-api-python-client = "2.188.0"
 google-auth = "1.35.0"
 hubspot-api-client = "^6.1.0"
 ipython = "^9.0.0"
@@ -67,7 +67,7 @@ zeep = "4.3.2"
 bpython = "*"
 django-debug-toolbar = "*"
 factory-boy = "3.3.3"
-faker = "40.1.2"
+faker = "40.4.0"
 freezegun = "1.5.5"
 hypothesis = "4.24.6"
 ipdb = "*"