diff --git a/CHANGELOG.md b/CHANGELOG.md
index 43ee97124..a8c1f5728 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Bumped `@aws-sdk/credential-providers` to `^3.1000.0`. [#955](https://github.com/sourcebot-dev/sourcebot/pull/955)
 - Bumped `rollup` transitive dependency to `^4.59.0` via yarn resolutions. [#956](https://github.com/sourcebot-dev/sourcebot/pull/956)
 - Bumped `minimatch` transitive dependency to `^3.1.3` via yarn resolutions. [#957](https://github.com/sourcebot-dev/sourcebot/pull/957)
+- Bumped `nodemailer` to `7.0.11`. [#959](https://github.com/sourcebot-dev/sourcebot/pull/959)
 
 ## [4.13.0] - 2026-02-27
 
diff --git a/packages/web/package.json b/packages/web/package.json
index c06af493d..812f34e92 100644
--- a/packages/web/package.json
+++ b/packages/web/package.json
@@ -155,7 +155,7 @@
     "next-auth": "^5.0.0-beta.30",
     "next-navigation-guard": "^0.2.0",
     "next-themes": "^0.3.0",
-    "nodemailer": "^6.10.0",
+    "nodemailer": "^7.0.11",
     "octokit": "^4.1.3",
     "openai": "^4.98.0",
     "parse-diff": "^0.11.1",
diff --git a/yarn.lock b/yarn.lock
index 244752b93..2f932c177 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -8576,7 +8576,7 @@ __metadata:
     next-auth: "npm:^5.0.0-beta.30"
     next-navigation-guard: "npm:^0.2.0"
     next-themes: "npm:^0.3.0"
-    nodemailer: "npm:^6.10.0"
+    nodemailer: "npm:^7.0.11"
     npm-run-all: "npm:^4.1.5"
     octokit: "npm:^4.1.3"
     openai: "npm:^4.98.0"
@@ -16890,10 +16890,10 @@ __metadata:
   languageName: node
   linkType: hard
 
-"nodemailer@npm:^6.10.0":
-  version: 6.10.0
-  resolution: "nodemailer@npm:6.10.0"
-  checksum: 10c0/39fd35d65b021b94c968eeac82a66dd843021b6ba53c659d01b1dd4cda73b6a2f96e20facfe500efa4b8d3f1cb23df10245c6c86b2bde5f806691ed17ce87826
+"nodemailer@npm:^7.0.11":
+  version: 7.0.13
+  resolution: "nodemailer@npm:7.0.13"
+  checksum: 10c0/b26aa5b9fa4a033bbc1e1c16ef75ee2a9c8641fd290c00a8361d6a251b3c1b8bad545a23efa627f59cb266340a448891ea8aa49d8a9307c767b8505219d95079
   languageName: node
   linkType: hard