diff --git a/Cargo.lock b/Cargo.lock
index 6f32d14609087..417b1f8c76624 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -91,6 +91,55 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"
 
+[[package]]
+name = "anstream"
+version = "0.6.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
+dependencies = [
+ "anstyle",
+ "anstyle-parse",
+ "anstyle-query",
+ "anstyle-wincon",
+ "colorchoice",
+ "is_terminal_polyfill",
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
+
+[[package]]
+name = "anstyle-parse"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
+dependencies = [
+ "utf8parse",
+]
+
+[[package]]
+name = "anstyle-query"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
+dependencies = [
+ "windows-sys 0.59.0",
+]
+
+[[package]]
+name = "anstyle-wincon"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
+dependencies = [
+ "anstyle",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "anyhow"
 version = "1.0.66"
@@ -1239,7 +1288,7 @@ dependencies = [
  "anyhow",
  "camino",
  "cargo_toml",
- "clap",
+ "clap 4.5.23",
  "convert_case",
  "guppy",
  "md-5",
@@ -1427,33 +1476,49 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "3.2.24"
+version = "3.2.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eef2b3ded6a26dfaec672a742c93c8cf6b689220324da509ec5caa20de55dc83"
+checksum = "4ea181bf566f71cb9a5d17a59e1871af638180a18fb0035c92ae62b705207123"
 dependencies = [
- "atty",
  "bitflags 1.3.2",
- "clap_derive",
- "clap_lex",
+ "clap_lex 0.2.2",
  "indexmap 1.9.1",
- "once_cell",
- "strsim",
- "termcolor",
- "terminal_size",
  "textwrap",
 ]
 
+[[package]]
+name = "clap"
+version = "4.5.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
+dependencies = [
+ "clap_builder",
+ "clap_derive",
+]
+
+[[package]]
+name = "clap_builder"
+version = "4.5.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
+dependencies = [
+ "anstream",
+ "anstyle",
+ "clap_lex 0.7.4",
+ "strsim 0.11.1",
+ "terminal_size 0.4.1",
+]
+
 [[package]]
 name = "clap_derive"
-version = "3.2.24"
+version = "4.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d756c5824fc5c0c1ee8e36000f576968dbcb2081def956c83fad6f40acd46f96"
+checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
 dependencies = [
- "heck",
- "proc-macro-error",
+ "heck 0.5.0",
  "proc-macro2",
  "quote",
- "syn 1.0.107",
+ "syn 2.0.63",
 ]
 
 [[package]]
@@ -1465,6 +1530,12 @@ dependencies = [
  "os_str_bytes",
 ]
 
+[[package]]
+name = "clap_lex"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
+
 [[package]]
 name = "cmake"
 version = "0.1.50"
@@ -1484,6 +1555,12 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "colorchoice"
+version = "1.0.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
+
 [[package]]
 name = "columnar"
 version = "0.2.0"
@@ -1715,7 +1792,7 @@ dependencies = [
  "atty",
  "cast",
  "ciborium",
- "clap",
+ "clap 3.2.25",
  "criterion-plot",
  "futures",
  "itertools 0.10.5",
@@ -1932,7 +2009,7 @@ dependencies = [
  "ident_case",
  "proc-macro2",
  "quote",
- "strsim",
+ "strsim 0.10.0",
  "syn 2.0.63",
 ]
 
@@ -2273,7 +2350,7 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9720bba047d567ffc8a3cba48bf19126600e249ab7f128e9233e6376976a116"
 dependencies = [
- "heck",
+ "heck 0.4.0",
  "proc-macro2",
  "quote",
  "syn 1.0.107",
@@ -2915,6 +2992,12 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2540771e65fc8cb83cd6e8a237f70c319bd5c29f78ed1084ba5d50eeac86f7f9"
 
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hermit-abi"
 version = "0.1.6"
@@ -3370,6 +3453,12 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "879d54834c8c76457ef4293a689b2a8c59b076067ad77b15efafbb05f92a592b"
 
+[[package]]
+name = "is_terminal_polyfill"
+version = "1.70.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
+
 [[package]]
 name = "itertools"
 version = "0.10.5"
@@ -4180,7 +4269,7 @@ version = "0.3.0"
 dependencies = [
  "assert_cmd",
  "axum",
- "clap",
+ "clap 4.5.23",
  "csv",
  "dirs",
  "hyper 1.4.1",
@@ -4445,7 +4534,7 @@ dependencies = [
  "bytes",
  "bytesize",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "domain",
  "futures",
  "humantime",
@@ -4517,7 +4606,7 @@ dependencies = [
  "bytes",
  "bytesize",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "derivative",
  "differential-dataflow",
  "fail",
@@ -4583,7 +4672,7 @@ version = "0.128.0-dev.0"
 dependencies = [
  "anyhow",
  "arrow",
- "clap",
+ "clap 4.5.23",
  "futures",
  "mz-adapter",
  "mz-build-info",
@@ -4710,7 +4799,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "bytesize",
- "clap",
+ "clap 4.5.23",
  "crossbeam-channel",
  "dec",
  "differential-dataflow",
@@ -4774,7 +4863,7 @@ version = "0.128.0-dev.0"
 dependencies = [
  "anyhow",
  "axum",
- "clap",
+ "clap 4.5.23",
  "fail",
  "futures",
  "hyper 1.4.1",
@@ -4813,7 +4902,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "bytesize",
- "clap",
+ "clap 4.5.23",
  "core_affinity",
  "crossbeam-channel",
  "dec",
@@ -5062,7 +5151,7 @@ dependencies = [
  "bytesize",
  "cc",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "datadriven",
  "derivative",
  "fail",
@@ -5270,7 +5359,7 @@ version = "0.0.0"
 dependencies = [
  "async-compression",
  "bytes",
- "clap",
+ "clap 4.5.23",
  "csv-async",
  "futures",
  "insta",
@@ -5310,7 +5399,7 @@ dependencies = [
  "anyhow",
  "axum",
  "base64 0.13.1",
- "clap",
+ "clap 4.5.23",
  "derivative",
  "futures",
  "jsonwebtoken",
@@ -5356,7 +5445,7 @@ dependencies = [
  "axum-extra",
  "base64 0.22.0",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "hyper 1.4.1",
  "jsonwebtoken",
  "mz-frontegg-auth",
@@ -5404,7 +5493,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "criterion",
  "differential-dataflow",
  "itertools 0.10.5",
@@ -5439,7 +5528,7 @@ dependencies = [
  "aws-types",
  "base64 0.22.0",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "crossbeam",
  "fancy-regex",
  "futures",
@@ -5624,7 +5713,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "fail",
  "futures",
  "k8s-openapi",
@@ -5677,7 +5766,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "clap",
+ "clap 4.5.23",
  "derivative",
  "futures-core",
  "http 1.1.0",
@@ -5705,7 +5794,7 @@ dependencies = [
  "async-trait",
  "axum",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "futures",
  "http 1.1.0",
  "k8s-controller",
@@ -5744,7 +5833,7 @@ dependencies = [
  "async-trait",
  "bytes",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "compact_bytes",
  "console-subscriber",
  "criterion",
@@ -5869,7 +5958,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "bytes",
- "clap",
+ "clap 4.5.23",
  "criterion",
  "datadriven",
  "differential-dataflow",
@@ -5997,7 +6086,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "bytes",
- "clap",
+ "clap 4.5.23",
  "datadriven",
  "fallible-iterator",
  "mz-ore",
@@ -6256,7 +6345,7 @@ dependencies = [
  "serde_json",
  "smallvec",
  "static_assertions",
- "strsim",
+ "strsim 0.10.0",
  "thiserror",
  "timely",
  "tokio-postgres",
@@ -6338,7 +6427,7 @@ dependencies = [
  "aws-config",
  "aws-sdk-s3",
  "bytefmt",
- "clap",
+ "clap 4.5.23",
  "futures",
  "indicatif",
  "mz-aws-util",
@@ -6383,7 +6472,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "async-trait",
- "clap",
+ "clap 4.5.23",
  "futures",
  "mz-dyncfg",
  "mz-ore",
@@ -6405,7 +6494,7 @@ dependencies = [
  "anyhow",
  "async-stream",
  "async-trait",
- "clap",
+ "clap 4.5.23",
  "crossbeam-channel",
  "futures",
  "http 1.1.0",
@@ -6449,7 +6538,7 @@ dependencies = [
  "aws-sdk-sts",
  "bitflags 1.3.2",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "datadriven",
  "derivative",
  "dynfmt",
@@ -6573,7 +6662,7 @@ dependencies = [
  "anyhow",
  "bytes",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "dec",
  "fallible-iterator",
  "futures",
@@ -6654,7 +6743,7 @@ dependencies = [
  "bytes",
  "bytesize",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "columnation",
  "crossbeam-channel",
  "csv-core",
@@ -6960,7 +7049,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "flate2",
  "futures",
  "globset",
@@ -7765,7 +7854,7 @@ dependencies = [
  "async-trait",
  "axum",
  "bytes",
- "clap",
+ "clap 4.5.23",
  "differential-dataflow",
  "futures",
  "humantime",
@@ -7993,7 +8082,7 @@ dependencies = [
 [[package]]
 name = "postgres-protocol"
 version = "0.6.7"
-source = "git+https://github.com/MaterializeInc/rust-postgres#548f00c4cbcf7bd714c29cfd2fea7685040c9987"
+source = "git+https://github.com/MaterializeInc/rust-postgres#7d2f14e35e97973995c39662cde618036a0f9484"
 dependencies = [
  "base64 0.22.0",
  "byteorder",
@@ -8025,7 +8114,7 @@ dependencies = [
 [[package]]
 name = "postgres-types"
 version = "0.2.7"
-source = "git+https://github.com/MaterializeInc/rust-postgres#548f00c4cbcf7bd714c29cfd2fea7685040c9987"
+source = "git+https://github.com/MaterializeInc/rust-postgres#7d2f14e35e97973995c39662cde618036a0f9484"
 dependencies = [
  "bytes",
  "chrono",
@@ -8245,7 +8334,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f8650aabb6c35b860610e9cff5dc1af886c9e25073b7b1712a68972af4281302"
 dependencies = [
  "bytes",
- "heck",
+ "heck 0.4.0",
  "itertools 0.12.1",
  "log",
  "multimap",
@@ -9582,6 +9671,12 @@ version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "73473c0e59e6d5812c5dfe2a064a6444949f089e20eec9a2e5506596494e4623"
 
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "subprocess"
 version = "0.2.9"
@@ -9722,7 +9817,7 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "beca1b4eaceb4f2755df858b88d9b9315b7ccfd1ffd0d7a48a52602301f01a57"
 dependencies = [
- "heck",
+ "heck 0.4.0",
  "proc-macro-error",
  "proc-macro2",
  "quote",
@@ -9811,13 +9906,23 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
+[[package]]
+name = "terminal_size"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5352447f921fda68cf61b4101566c0bdb5104eff6804d0678e5227580ab6a4e9"
+dependencies = [
+ "rustix 0.38.34",
+ "windows-sys 0.59.0",
+]
+
 [[package]]
 name = "textwrap"
 version = "0.16.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "23d434d3f8967a09480fb04132ebe0a3e088c173e6d0ee7897abbdf4eab0f8b9"
 dependencies = [
- "terminal_size",
+ "terminal_size 0.2.6",
 ]
 
 [[package]]
@@ -10132,7 +10237,7 @@ dependencies = [
 [[package]]
 name = "tokio-postgres"
 version = "0.7.11"
-source = "git+https://github.com/MaterializeInc/rust-postgres#548f00c4cbcf7bd714c29cfd2fea7685040c9987"
+source = "git+https://github.com/MaterializeInc/rust-postgres#7d2f14e35e97973995c39662cde618036a0f9484"
 dependencies = [
  "async-trait",
  "byteorder",
@@ -11236,7 +11341,7 @@ dependencies = [
  "camino",
  "cc",
  "chrono",
- "clap",
+ "clap 4.5.23",
  "console",
  "criterion",
  "crossbeam-deque",
diff --git a/misc/bazel/cargo-gazelle/Cargo.toml b/misc/bazel/cargo-gazelle/Cargo.toml
index 87276e946efe0..4c9604c3761b8 100644
--- a/misc/bazel/cargo-gazelle/Cargo.toml
+++ b/misc/bazel/cargo-gazelle/Cargo.toml
@@ -16,7 +16,7 @@ workspace = true
 anyhow = "1.0.66"
 camino = "1"
 cargo_toml = "0.19.1"
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 convert_case = "0.6"
 guppy = "0.17.5"
 md-5 = "0.10.5"
diff --git a/src/balancerd/Cargo.toml b/src/balancerd/Cargo.toml
index f7f4fa39fd64e..72d37425defb8 100644
--- a/src/balancerd/Cargo.toml
+++ b/src/balancerd/Cargo.toml
@@ -16,7 +16,7 @@ axum = "0.7.5"
 bytes = "1.3.0"
 bytesize = "1.1.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 domain = { version = "0.9.3", default-features = false, features = ["resolv"] }
 futures = "0.3.25"
 humantime = "2.1.0"
diff --git a/src/catalog-debug/Cargo.toml b/src/catalog-debug/Cargo.toml
index 0b6dc11447511..ba441b0d660b2 100644
--- a/src/catalog-debug/Cargo.toml
+++ b/src/catalog-debug/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 arrow = { version = "53.3.0", default-features = false }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 futures = "0.3.25"
 mz-adapter = { path = "../adapter" }
 mz-build-info = { path = "../build-info" }
diff --git a/src/catalog/Cargo.toml b/src/catalog/Cargo.toml
index d6bff1a4f413b..c397e9c90a2b2 100644
--- a/src/catalog/Cargo.toml
+++ b/src/catalog/Cargo.toml
@@ -16,7 +16,7 @@ bincode = { version = "1.3.3" }
 bytes = { version = "1.3.0", features = ["serde"] }
 bytesize = "1.1.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 derivative = "2.2.0"
 differential-dataflow = "0.13.2"
 fail = { version = "0.5.1", features = ["failpoints"] }
diff --git a/src/cluster/Cargo.toml b/src/cluster/Cargo.toml
index e480fa8eb7379..11e91e607f959 100644
--- a/src/cluster/Cargo.toml
+++ b/src/cluster/Cargo.toml
@@ -13,7 +13,7 @@ workspace = true
 anyhow = "1.0.66"
 async-trait = "0.1.68"
 bytesize = "1.1.0"
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 crossbeam-channel = "0.5.8"
 dec = { version = "0.4.8", features = ["serde"] }
 differential-dataflow = "0.13.2"
diff --git a/src/clusterd/Cargo.toml b/src/clusterd/Cargo.toml
index 5e76640a20ad0..590039e0c32bc 100644
--- a/src/clusterd/Cargo.toml
+++ b/src/clusterd/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 axum = "0.7.5"
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 fail = { version = "0.5.1", features = ["failpoints"] }
 futures = "0.3.25"
 hyper = "1.4.1"
diff --git a/src/compute/Cargo.toml b/src/compute/Cargo.toml
index 913376445ad23..e715cff5009bd 100644
--- a/src/compute/Cargo.toml
+++ b/src/compute/Cargo.toml
@@ -14,7 +14,7 @@ anyhow = "1.0.66"
 async-stream = "0.3.3"
 async-trait = "0.1.68"
 bytesize = "1.1.0"
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 crossbeam-channel = "0.5.8"
 dec = { version = "0.4.8", features = ["serde"] }
 differential-dataflow = "0.13.2"
diff --git a/src/environmentd/Cargo.toml b/src/environmentd/Cargo.toml
index 223febbed2fb8..64951f15d1e54 100644
--- a/src/environmentd/Cargo.toml
+++ b/src/environmentd/Cargo.toml
@@ -21,7 +21,7 @@ base64 = "0.13.1"
 bytes = "1.3.0"
 bytesize = "1.1.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["wrap_help", "env", "derive"] }
+clap = { version = "4.5.23", features = ["wrap_help", "env", "derive"] }
 derivative = "2.2.0"
 fail = { version = "0.5.1", features = ["failpoints"] }
 futures = "0.3.25"
diff --git a/src/fivetran-destination/Cargo.toml b/src/fivetran-destination/Cargo.toml
index ecfe215472d52..ceb9adf82f392 100644
--- a/src/fivetran-destination/Cargo.toml
+++ b/src/fivetran-destination/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 async-compression = { version = "0.4.5", features = ["gzip", "tokio", "zstd"] }
 bytes = "1.3.0"
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 csv-async = { version = "1.2.6", default-features = false, features = ["tokio"] }
 futures = "0.3.25"
 itertools = "0.10.5"
diff --git a/src/frontegg-auth/Cargo.toml b/src/frontegg-auth/Cargo.toml
index 70119e4353a34..9a126cf929714 100644
--- a/src/frontegg-auth/Cargo.toml
+++ b/src/frontegg-auth/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 base64 = "0.13.1"
-clap = { version = "3.2.24", features = ["wrap_help", "env", "derive"] }
+clap = { version = "4.5.23", features = ["wrap_help", "env", "derive"] }
 derivative = "2.2.0"
 futures = "0.3.25"
 jsonwebtoken = "9.2.0"
diff --git a/src/frontegg-mock/Cargo.toml b/src/frontegg-mock/Cargo.toml
index cc30f0d057287..cb8ac4fd76e8a 100644
--- a/src/frontegg-mock/Cargo.toml
+++ b/src/frontegg-mock/Cargo.toml
@@ -15,7 +15,7 @@ axum = "0.7.5"
 axum-extra = { version = "0.9.3", features = ["typed-header"] }
 base64 = "0.22.0"
 chrono = { version = "0.4.35", default-features = false, features = ["serde"] }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 hyper = { version = "1.4.1", features = ["http1", "server"] }
 jsonwebtoken = "9.2.0"
 mz-frontegg-auth = { path = "../frontegg-auth" }
diff --git a/src/interchange/Cargo.toml b/src/interchange/Cargo.toml
index 901b5338b89b6..0a5604cd842c4 100644
--- a/src/interchange/Cargo.toml
+++ b/src/interchange/Cargo.toml
@@ -19,7 +19,7 @@ anyhow = "1.0.66"
 byteorder = "1.4.3"
 bytes = "1.3.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 differential-dataflow = "0.13.2"
 itertools = "0.10.5"
 maplit = "1.0.2"
diff --git a/src/kafka-util/Cargo.toml b/src/kafka-util/Cargo.toml
index fb3c81bf8d3bf..8c93a8f295833 100644
--- a/src/kafka-util/Cargo.toml
+++ b/src/kafka-util/Cargo.toml
@@ -17,7 +17,7 @@ aws-sigv4 = { version = "1.2.0" }
 aws-types = "1.1.1"
 base64 = "0.22.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 crossbeam = "0.8.2"
 fancy-regex = "0.11.0"
 futures = "0.3.25"
diff --git a/src/mz/Cargo.toml b/src/mz/Cargo.toml
index 5366a3a5997da..4f22540bc350d 100644
--- a/src/mz/Cargo.toml
+++ b/src/mz/Cargo.toml
@@ -11,7 +11,7 @@ workspace = true
 
 [dependencies]
 axum = "0.7.5"
-clap = { version = "3.2.24", features = [ "derive" ] }
+clap = { version = "4.5.23", features = [ "derive" ] }
 csv = "1.2.1"
 dirs = "5.0.0"
 indicatif = "0.17.2"
diff --git a/src/orchestrator-kubernetes/Cargo.toml b/src/orchestrator-kubernetes/Cargo.toml
index d5f12e153dabc..2111c11c38628 100644
--- a/src/orchestrator-kubernetes/Cargo.toml
+++ b/src/orchestrator-kubernetes/Cargo.toml
@@ -13,7 +13,7 @@ workspace = true
 anyhow = "1.0.66"
 async-trait = "0.1.68"
 chrono = { version = "0.4.35", default-features = false }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 fail = { version = "0.5.1", features = ["failpoints"] }
 futures = "0.3.25"
 maplit = "1.0.2"
diff --git a/src/orchestrator-tracing/Cargo.toml b/src/orchestrator-tracing/Cargo.toml
index b800b0ed83d34..9b7507bcb3c21 100644
--- a/src/orchestrator-tracing/Cargo.toml
+++ b/src/orchestrator-tracing/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 async-trait = "0.1.68"
-clap = { version = "3.2.24", features = ["env", "derive"] }
+clap = { version = "4.5.23", features = ["env", "derive"] }
 derivative = "2.2.0"
 futures-core = "0.3.21"
 http = "1.1.0"
diff --git a/src/orchestratord/Cargo.toml b/src/orchestratord/Cargo.toml
index 2028d5d2733c3..4eb0f44a18f33 100644
--- a/src/orchestratord/Cargo.toml
+++ b/src/orchestratord/Cargo.toml
@@ -14,7 +14,7 @@ anyhow = "1.0.66"
 async-trait = "0.1.68"
 axum = "0.7.5"
 chrono = { version = "0.4.35", default-features = false }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 futures = "0.3.25"
 http = "1.1.0"
 k8s-controller = "0.3.3"
diff --git a/src/ore/Cargo.toml b/src/ore/Cargo.toml
index fdb2f693c3323..dccd1ec30164a 100644
--- a/src/ore/Cargo.toml
+++ b/src/ore/Cargo.toml
@@ -23,7 +23,7 @@ bytes = { version = "1.3.0", optional = true }
 chrono = { version = "0.4.35", default-features = false, features = [
   "std",
 ], optional = true }
-clap = { version = "3.2.24", features = ["env"], optional = true }
+clap = { version = "4.5.23", features = ["env"], optional = true }
 compact_bytes = { version = "0.1.2", optional = true }
 ctor = { version = "0.1.26", optional = true }
 derivative = { version = "2.2.0", optional = true }
diff --git a/src/persist-cli/Cargo.toml b/src/persist-cli/Cargo.toml
index aac3e08dc3b17..2a82df2d38bbf 100644
--- a/src/persist-cli/Cargo.toml
+++ b/src/persist-cli/Cargo.toml
@@ -22,7 +22,7 @@ arrow = { version = "53.3.0", default-features = false }
 async-trait = "0.1.68"
 axum = "0.7.5"
 bytes = { version = "1.3.0", features = ["serde"] }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 differential-dataflow = "0.13.2"
 futures = "0.3.25"
 humantime = "2.1.0"
diff --git a/src/persist-client/Cargo.toml b/src/persist-client/Cargo.toml
index d02d55148b05d..4adc825b486fb 100644
--- a/src/persist-client/Cargo.toml
+++ b/src/persist-client/Cargo.toml
@@ -34,7 +34,7 @@ arrow = { version = "53.3.0", default-features = false }
 async-stream = "0.3.3"
 async-trait = "0.1.68"
 bytes = { version = "1.3.0", features = ["serde"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 differential-dataflow = "0.13.2"
 futures = "0.3.25"
 futures-util = "0.3"
diff --git a/src/pgtest/Cargo.toml b/src/pgtest/Cargo.toml
index cd86153993a2b..22cc7dcaa35db 100644
--- a/src/pgtest/Cargo.toml
+++ b/src/pgtest/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 bytes = "1.3.0"
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 datadriven = "0.8.0"
 fallible-iterator = "0.2.0"
 mz-ore = { path = "../ore", features = ["cli"] }
diff --git a/src/s3-datagen/Cargo.toml b/src/s3-datagen/Cargo.toml
index abcf9ec29aab1..105f9a2c6e2c1 100644
--- a/src/s3-datagen/Cargo.toml
+++ b/src/s3-datagen/Cargo.toml
@@ -14,7 +14,7 @@ anyhow = "1.0.66"
 aws-config = { version = "1.2.0", default-features = false }
 aws-sdk-s3 = { version = "1.23.0", default-features = false, features = ["rt-tokio"] }
 bytefmt = "0.1.7"
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 futures = "0.3.25"
 indicatif = "0.17.2"
 mz-aws-util = { path = "../aws-util", features = ["s3"] }
diff --git a/src/server-core/Cargo.toml b/src/server-core/Cargo.toml
index 739369586abce..024ab12672117 100644
--- a/src/server-core/Cargo.toml
+++ b/src/server-core/Cargo.toml
@@ -12,7 +12,7 @@ workspace = true
 [dependencies]
 anyhow = "1.0.66"
 async-trait = { version = "0.1.68" }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 openssl = { version = "0.10.48", features = ["vendored"] }
 scopeguard = "1.1.0"
 socket2 = "0.5.3"
diff --git a/src/service/Cargo.toml b/src/service/Cargo.toml
index bb315164a9620..c54d77f2dda0b 100644
--- a/src/service/Cargo.toml
+++ b/src/service/Cargo.toml
@@ -13,7 +13,7 @@ workspace = true
 anyhow = "1.0.66"
 async-stream = "0.3.3"
 async-trait = "0.1.68"
-clap = { version = "3.2.24", features = ["env", "derive"] }
+clap = { version = "4.5.23", features = ["env", "derive"] }
 crossbeam-channel = "0.5.8"
 futures = "0.3.25"
 http = "1.1.0"
diff --git a/src/sql/Cargo.toml b/src/sql/Cargo.toml
index 998711bea6bee..7bcca6e2ab7f7 100644
--- a/src/sql/Cargo.toml
+++ b/src/sql/Cargo.toml
@@ -17,7 +17,7 @@ aws-sdk-sts = { version = "1.7.0", default-features = false, features = [
 ] }
 bitflags = "1.3.2"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 derivative = "2.2.0"
 dynfmt = { version = "0.1.5", features = ["curly"] }
 enum-kinds = "0.5.1"
diff --git a/src/sqllogictest/Cargo.toml b/src/sqllogictest/Cargo.toml
index 49db135fc535c..64197632c3115 100644
--- a/src/sqllogictest/Cargo.toml
+++ b/src/sqllogictest/Cargo.toml
@@ -13,7 +13,7 @@ workspace = true
 anyhow = "1.0.66"
 bytes = "1.3.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 dec = "0.4.8"
 fallible-iterator = "0.2.0"
 futures = "0.3.25"
diff --git a/src/storage/Cargo.toml b/src/storage/Cargo.toml
index d096f0b5a4ee6..e75efc54ed8aa 100644
--- a/src/storage/Cargo.toml
+++ b/src/storage/Cargo.toml
@@ -21,7 +21,7 @@ bytes = { version = "1.3.0", features = ["serde"] }
 bytesize = "1.1.0"
 bincode = "1"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 columnation = "0.1.0"
 crossbeam-channel = "0.5.8"
 csv-core = { version = "0.1.10" }
@@ -104,7 +104,7 @@ tonic-build = "0.12.1"
 [dev-dependencies]
 async-trait = "0.1.68"
 axum = "0.7.5"
-clap = { version = "3.2.24", features = ["derive", "env"] }
+clap = { version = "4.5.23", features = ["derive", "env"] }
 datadriven = { version = "0.8.0", features = ["async"] }
 humantime = "2.1.0"
 mz-http-util = { path = "../http-util" }
diff --git a/src/testdrive/Cargo.toml b/src/testdrive/Cargo.toml
index fc586ef9838ca..3aad4546b470f 100644
--- a/src/testdrive/Cargo.toml
+++ b/src/testdrive/Cargo.toml
@@ -21,7 +21,7 @@ arrow = { version = "53.3.0", default-features = false }
 byteorder = "1.5"
 bytes = "1.3.0"
 chrono = { version = "0.4.35", default-features = false, features = ["std"] }
-clap = { version = "3.2.24", features = ["derive"] }
+clap = { version = "4.5.23", features = ["derive"] }
 flate2 = "1.0.24"
 futures = "0.3.25"
 globset = "0.4.14"
diff --git a/src/workspace-hack/Cargo.toml b/src/workspace-hack/Cargo.toml
index 64b5c0e8c2b33..c5d24b06f2e18 100644
--- a/src/workspace-hack/Cargo.toml
+++ b/src/workspace-hack/Cargo.toml
@@ -34,7 +34,7 @@ bstr-dff4ba8e3ae991db = { package = "bstr", version = "1.10.0" }
 byteorder = { version = "1.5.0" }
 bytes = { version = "1.4.0", features = ["serde"] }
 chrono = { version = "0.4.35", default-features = false, features = ["clock", "serde"] }
-clap = { version = "3.2.24", features = ["derive", "env", "wrap_help"] }
+clap = { version = "4.5.23", features = ["derive", "env", "wrap_help"] }
 console = { version = "0.15.5", default-features = false, features = ["ansi-parsing", "unicode-width"] }
 criterion = { version = "0.4.0", features = ["async_tokio", "html_reports"] }
 crossbeam-deque = { version = "0.8.3" }
@@ -166,7 +166,7 @@ byteorder = { version = "1.5.0" }
 bytes = { version = "1.4.0", features = ["serde"] }
 cc = { version = "1.1.28", default-features = false, features = ["parallel"] }
 chrono = { version = "0.4.35", default-features = false, features = ["clock", "serde"] }
-clap = { version = "3.2.24", features = ["derive", "env", "wrap_help"] }
+clap = { version = "4.5.23", features = ["derive", "env", "wrap_help"] }
 console = { version = "0.15.5", default-features = false, features = ["ansi-parsing", "unicode-width"] }
 criterion = { version = "0.4.0", features = ["async_tokio", "html_reports"] }
 crossbeam-deque = { version = "0.8.3" }