diff --git a/locksmith/package.json b/locksmith/package.json
index c00eed9a68c..8dca0fec1a0 100644
--- a/locksmith/package.json
+++ b/locksmith/package.json
@@ -69,7 +69,7 @@
     "geoip-country": "5.0.202510312342",
     "google-auth-library": "9.15.1",
     "graphile-worker": "0.16.6",
-    "graphql": "16.10.0",
+    "graphql": "17.0.1",
     "ics": "3.8.1",
     "isomorphic-fetch": "3.0.0",
     "jsonwebtoken": "9.0.2",
diff --git a/packages/unlock-js/package.json b/packages/unlock-js/package.json
index 31265398f82..de7e9244bc2 100644
--- a/packages/unlock-js/package.json
+++ b/packages/unlock-js/package.json
@@ -52,7 +52,7 @@
     "vitest": "3.2.4"
   },
   "dependencies": {
-    "graphql": "16.11.0",
+    "graphql": "17.0.1",
     "graphql-request": "7.3.1",
     "siwe": "3.0.0"
   }
diff --git a/subgraph/package.json b/subgraph/package.json
index 2db7dd69940..bbd95d66802 100644
--- a/subgraph/package.json
+++ b/subgraph/package.json
@@ -38,7 +38,7 @@
   },
   "devDependencies": {
     "ethers": "6.13.5",
-    "graphql": "16.9.0",
+    "graphql": "17.0.1",
     "matchstick-as": "0.6.0",
     "mustache": "4.2.0"
   }
diff --git a/unlock-app/package.json b/unlock-app/package.json
index 4c4d8ffcaf7..b9fbad348c9 100644
--- a/unlock-app/package.json
+++ b/unlock-app/package.json
@@ -40,7 +40,7 @@
     "file-saver": "2.0.5",
     "frames.js": "0.19.5",
     "from-exponential": "1.1.1",
-    "graphql": "16.9.0",
+    "graphql": "17.0.1",
     "lottie-react": "2.4.1",
     "next": "14.2.35",
     "next-recaptcha-v3": "1.5.2",
diff --git a/yarn.lock b/yarn.lock
index 33ccaeb367a..f67557d9349 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -20938,7 +20938,7 @@ __metadata:
     geoip-country: "npm:5.0.202510312342"
     google-auth-library: "npm:9.15.1"
     graphile-worker: "npm:0.16.6"
-    graphql: "npm:16.10.0"
+    graphql: "npm:17.0.1"
     ics: "npm:3.8.1"
     isomorphic-fetch: "npm:3.0.0"
     jsonwebtoken: "npm:9.0.2"
@@ -21098,7 +21098,7 @@ __metadata:
     eslint: "npm:9.22.0"
     ethers: "npm:6.13.5"
     fs-extra: "npm:11.2.0"
-    graphql: "npm:16.9.0"
+    graphql: "npm:17.0.1"
     handlebars: "npm:4.7.8"
     matchstick-as: "npm:0.6.0"
     mustache: "npm:4.2.0"
@@ -21221,7 +21221,7 @@ __metadata:
     file-saver: "npm:2.0.5"
     frames.js: "npm:0.19.5"
     from-exponential: "npm:1.1.1"
-    graphql: "npm:16.9.0"
+    graphql: "npm:17.0.1"
     jsdom: "npm:26.0.0"
     lottie-react: "npm:2.4.1"
     next: "npm:14.2.35"
@@ -21291,7 +21291,7 @@ __metadata:
     "@unlock-protocol/types": "workspace:./packages/types"
     eslint: "npm:9.39.0"
     ethers: "npm:6.15.0"
-    graphql: "npm:16.11.0"
+    graphql: "npm:17.0.1"
     graphql-request: "npm:7.3.1"
     hardhat: "npm:2.26.3"
     prettier: "npm:3.6.2"
@@ -32964,20 +32964,6 @@ __metadata:
   languageName: node
   linkType: hard
 
-"graphql@npm:16.10.0, graphql@npm:^16.6.0":
-  version: 16.10.0
-  resolution: "graphql@npm:16.10.0"
-  checksum: 10/d42cf81ddcf3a61dfb213217576bf33c326f15b02c4cee369b373dc74100cbdcdc4479b3b797e79b654dabd8fddf50ef65ff75420e9ce5596c02e21f24c9126a
-  languageName: node
-  linkType: hard
-
-"graphql@npm:16.11.0":
-  version: 16.11.0
-  resolution: "graphql@npm:16.11.0"
-  checksum: 10/e3e1633d0b464bbb3fa41283fae938bd3bac801c350555b3f1a129d99fb3cfe157fa69c1389229dba902731942eb08bdea4b29f1271965feee8779576b26ef01
-  languageName: node
-  linkType: hard
-
 "graphql@npm:16.6.0":
   version: 16.6.0
   resolution: "graphql@npm:16.6.0"
@@ -32985,10 +32971,17 @@ __metadata:
   languageName: node
   linkType: hard
 
-"graphql@npm:16.9.0":
-  version: 16.9.0
-  resolution: "graphql@npm:16.9.0"
-  checksum: 10/5833f82bb6c31bec120bbf9cd400eda873e1bb7ef5c17974fa262cd82dc68728fda5d4cb859dc8aaa4c4fe4f6fe1103a9c47efc01a12c02ae5cb581d8e4029e2
+"graphql@npm:17.0.1":
+  version: 17.0.1
+  resolution: "graphql@npm:17.0.1"
+  checksum: 10/f59d39448ec380e0378958cf834905e12e86cbcbe06bc6739a3d903b575f30a87cffee98bd838c40d2546253278e3faf0c4ec848817cda17f663185c511a80ae
+  languageName: node
+  linkType: hard
+
+"graphql@npm:^16.6.0":
+  version: 16.10.0
+  resolution: "graphql@npm:16.10.0"
+  checksum: 10/d42cf81ddcf3a61dfb213217576bf33c326f15b02c4cee369b373dc74100cbdcdc4479b3b797e79b654dabd8fddf50ef65ff75420e9ce5596c02e21f24c9126a
   languageName: node
   linkType: hard