diff --git a/versions.lock b/versions.lock
index e637bda4c..c4ea940ad 100644
--- a/versions.lock
+++ b/versions.lock
@@ -61,8 +61,8 @@ org.apache.maven.shared:maven-dependency-analyzer:1.15.1 (1 constraints: 3a05393
 org.apache.maven.shared:maven-shared-utils:3.3.4 (1 constraints: e60b61f3)
 org.checkerframework:checker-qual:3.48.1 (4 constraints: 3f38c95b)
 org.checkerframework:dataflow-nullaway:3.48.1 (2 constraints: 7511b6f2)
-org.codehaus.groovy:groovy:3.0.13 (3 constraints: 3a295322)
-org.codehaus.groovy:groovy-xml:3.0.13 (1 constraints: 791161da)
+org.codehaus.groovy:groovy:3.0.21 (3 constraints: 39290322)
+org.codehaus.groovy:groovy-xml:3.0.21 (1 constraints: 791161da)
 org.codehaus.plexus:plexus-cipher:2.0 (1 constraints: 641174c7)
 org.codehaus.plexus:plexus-classworlds:2.6.0 (3 constraints: 572b5104)
 org.codehaus.plexus:plexus-component-annotations:2.1.0 (2 constraints: 241d860a)
diff --git a/versions.props b/versions.props
index 9078beeb9..daf939270 100644
--- a/versions.props
+++ b/versions.props
@@ -53,7 +53,7 @@ com.palantir.javaformat:gradle-palantir-java-format = 1.1.0
 # Newer spotless versions have issues resolving dependencies at configuration time
 com.diffplug.spotless:spotless-plugin-gradle = 6.6.0
 # Groovy versions must be compatible with gradle
-org.codehaus.groovy:* = 3.0.13
+org.codehaus.groovy:* = 3.0.21
 # checkerframework dependencies should be limited to errorpropne and nullaway
 # requirements, upgrading prior to those often causes compilation failures.
 org.checkerframework:* = 3.48.1