diff --git a/admin/requirements-ansible.in b/admin/requirements-ansible.in
index 6fb2bdedb4..d940a60547 100644
--- a/admin/requirements-ansible.in
+++ b/admin/requirements-ansible.in
@@ -1,4 +1,4 @@
 Jinja2>=2.11.3
-ansible==2.9.7
+ansible>=2.9.13,<2.10.0
 cryptography>=3.2
 netaddr
diff --git a/admin/requirements-dev.in b/admin/requirements-dev.in
index e0beae576a..a0d9b146eb 100644
--- a/admin/requirements-dev.in
+++ b/admin/requirements-dev.in
@@ -6,6 +6,7 @@ mock
 pbr
 pip>=21.1
 pip-tools>=6.1.0
+py>=1.10.0
 pylint>=2.7.0; python_version > '3.6'
 pytest==3.2.0
 requests>=2.22.0
diff --git a/admin/requirements-dev.txt b/admin/requirements-dev.txt
index 0eb9ed069a..6ee51546bb 100644
--- a/admin/requirements-dev.txt
+++ b/admin/requirements-dev.txt
@@ -137,10 +137,11 @@ ptyprocess==0.5.2 \
     --hash=sha256:e64193f0047ad603b71f202332ab5527c5e52aa7c8b609704fc28c0dc20c4365 \
     --hash=sha256:e8c43b5eee76b2083a9badde89fd1bbce6c8942d1045146e100b7b5e014f4f1a
     # via pexpect
-py==1.9.0 \
-    --hash=sha256:366389d1db726cd2fcfc79732e75410e5fe4d31db13692115529d34069a043c2 \
-    --hash=sha256:9ca6883ce56b4e8da7e79ac18787889fa5206c79dcc67fb065376cd2fe03f342
+py==1.10.0 \
+    --hash=sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3 \
+    --hash=sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a
     # via
+    #   -r requirements-dev.in
     #   pytest
     #   pytest-catchlog
     #   tox
diff --git a/admin/requirements-testinfra.in b/admin/requirements-testinfra.in
index cb1721d8c5..d1740d0133 100644
--- a/admin/requirements-testinfra.in
+++ b/admin/requirements-testinfra.in
@@ -1,4 +1,5 @@
 pytest==6.1.1
 testinfra==5.3.1
+py>=1.10.0
 pytest-xdist==2.1.0
 paramiko==2.7.2
diff --git a/admin/requirements-testinfra.txt b/admin/requirements-testinfra.txt
index 9cadd03b50..6939f24f29 100644
--- a/admin/requirements-testinfra.txt
+++ b/admin/requirements-testinfra.txt
@@ -4,8 +4,8 @@
 #
 #    pip-compile --allow-unsafe --generate-hashes --output-file=requirements-testinfra.txt requirements-ansible.in requirements-testinfra.in requirements.in
 #
-ansible==2.9.7 \
-    --hash=sha256:7222ce925536a25b2912364e13b03a3e21dbf2f96799ebff304f48509324de7b
+ansible==2.9.21 \
+    --hash=sha256:4098246b67aa143e1e3af79d99346419e0545d5405d1cdf6e7fd389beab6de5a
     # via -r requirements-ansible.in
 apipkg==1.5 \
     --hash=sha256:37228cda29411948b422fae072f57e31d3396d2ee1c9783775980ee9c9990af6 \
@@ -170,10 +170,11 @@ prompt_toolkit==2.0.9 \
     --hash=sha256:2519ad1d8038fd5fc8e770362237ad0364d16a7650fb5724af6997ed5515e3c1 \
     --hash=sha256:977c6583ae813a37dc1c2e1b715892461fcbdaa57f6fc62f33a528c4886c8f55
     # via -r requirements.in
-py==1.9.0 \
-    --hash=sha256:366389d1db726cd2fcfc79732e75410e5fe4d31db13692115529d34069a043c2 \
-    --hash=sha256:9ca6883ce56b4e8da7e79ac18787889fa5206c79dcc67fb065376cd2fe03f342
+py==1.10.0 \
+    --hash=sha256:21b81bda15b66ef5e1a777a21c4dcd9c20ad3efd0b3f817e7a809035269e1bd3 \
+    --hash=sha256:3b80836aa6d1feeaa108e046da6423ab8f6ceda6468545ae8d02d9d58d18818a
     # via
+    #   -r requirements-testinfra.in
     #   pytest
     #   pytest-forked
 pycparser==2.20 \
diff --git a/admin/requirements.txt b/admin/requirements.txt
index 102d4a7f34..6275d19957 100644
--- a/admin/requirements.txt
+++ b/admin/requirements.txt
@@ -4,8 +4,8 @@
 #
 #    pip-compile --allow-unsafe --generate-hashes --output-file=requirements.txt requirements-ansible.in requirements.in
 #
-ansible==2.9.7 \
-    --hash=sha256:7222ce925536a25b2912364e13b03a3e21dbf2f96799ebff304f48509324de7b
+ansible==2.9.21 \
+    --hash=sha256:4098246b67aa143e1e3af79d99346419e0545d5405d1cdf6e7fd389beab6de5a
     # via -r requirements-ansible.in
 cffi==1.11.4 \
     --hash=sha256:0640f12f04f257c4467075a804a4920a5d07ef91e11c525fc65d715c08231c81 \
diff --git a/securedrop/requirements/python3/develop-requirements.in b/securedrop/requirements/python3/develop-requirements.in
index 404b9d2fb5..584c508d5a 100644
--- a/securedrop/requirements/python3/develop-requirements.in
+++ b/securedrop/requirements/python3/develop-requirements.in
@@ -1,6 +1,6 @@
 Jinja2>=2.11.3
 ansible-lint>=4.2.0
-ansible>=2.9.7,<2.10.0
+ansible>=2.9.13,<2.10.0
 argon2_cffi>=20.1.0
 bandit
 # yes, we need both boto and boto3
diff --git a/securedrop/requirements/python3/develop-requirements.txt b/securedrop/requirements/python3/develop-requirements.txt
index 0a9d8b4281..5eb02a53db 100644
--- a/securedrop/requirements/python3/develop-requirements.txt
+++ b/securedrop/requirements/python3/develop-requirements.txt
@@ -8,8 +8,8 @@ ansible-lint==4.2.0 \
     --hash=sha256:b9fc9a6564f5d60a4284497f966f38ef78f0e2505edbe2bd1225f1ade31c2d8a \
     --hash=sha256:eb925d8682d70563ccb80e2aca7b3edf84fb0b768cea3edc6846aac7abdc414a
     # via -r requirements/python3/develop-requirements.in
-ansible==2.9.7 \
-    --hash=sha256:7222ce925536a25b2912364e13b03a3e21dbf2f96799ebff304f48509324de7b
+ansible==2.9.21 \
+    --hash=sha256:4098246b67aa143e1e3af79d99346419e0545d5405d1cdf6e7fd389beab6de5a
     # via
     #   -r ../admin/requirements-ansible.in
     #   -r requirements/python3/develop-requirements.in