diff --git a/cluster/pulumi/common/package.json b/cluster/pulumi/common/package.json
index 3caf421b9f..546fc8c0ba 100644
--- a/cluster/pulumi/common/package.json
+++ b/cluster/pulumi/common/package.json
@@ -15,7 +15,7 @@
     "@pulumi/github": "6.13.1",
     "@types/auth0": "^3.3.11",
     "auth0": "^5.6.0",
-    "js-yaml": "^4.1.0",
+    "js-yaml": "^5.2.2",
     "lodash": "^4.18.1",
     "node-fetch": "^2.7.0",
     "ts-node": "^10.9.2",
diff --git a/cluster/pulumi/gha/package.json b/cluster/pulumi/gha/package.json
index 19a66ba5d1..03ab02aabf 100644
--- a/cluster/pulumi/gha/package.json
+++ b/cluster/pulumi/gha/package.json
@@ -4,7 +4,7 @@
   "main": "src/index.ts",
   "dependencies": {
     "@canton-network/splice-pulumi-common": "1.0.0",
-    "js-yaml": "^4.1.0"
+    "js-yaml": "^5.2.2"
   },
   "scripts": {
     "fix": "npm run format:fix && npm run lint:fix",
diff --git a/cluster/pulumi/package-lock.json b/cluster/pulumi/package-lock.json
index 8f668a304e..944ac308db 100644
--- a/cluster/pulumi/package-lock.json
+++ b/cluster/pulumi/package-lock.json
@@ -98,7 +98,7 @@
                 "@pulumi/std": "2.3.2",
                 "@types/auth0": "^3.3.11",
                 "auth0": "^5.6.0",
-                "js-yaml": "^4.1.0",
+                "js-yaml": "^5.2.2",
                 "lodash": "^4.18.1",
                 "node-fetch": "^2.7.0",
                 "ts-node": "^10.9.2",
@@ -128,6 +128,28 @@
                 "@canton-network/splice-pulumi-common": "1.0.0"
             }
         },
+        "common/node_modules/js-yaml": {
+            "version": "5.2.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+            "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
+            "license": "MIT",
+            "dependencies": {
+                "argparse": "^2.0.1"
+            },
+            "bin": {
+                "js-yaml": "bin/js-yaml.mjs"
+            }
+        },
         "deployment": {
             "name": "@canton-network/splice-deployment-operator",
             "dependencies": {
@@ -151,12 +173,34 @@
             "version": "1.0.0",
             "dependencies": {
                 "@canton-network/splice-pulumi-common": "1.0.0",
-                "js-yaml": "^4.1.0"
+                "js-yaml": "^5.2.2"
             },
             "devDependencies": {
                 "@types/js-yaml": "^4.0.5"
             }
         },
+        "gha/node_modules/js-yaml": {
+            "version": "5.2.2",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz",
+            "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==",
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
+            "license": "MIT",
+            "dependencies": {
+                "argparse": "^2.0.1"
+            },
+            "bin": {
+                "js-yaml": "bin/js-yaml.mjs"
+            }
+        },
         "infra": {
             "name": "@canton-network/splice-pulumi-infra",
             "dependencies": {