diff --git a/infra/requirements.txt b/infra/requirements.txt
index a4739c0..e95f53c 100644
--- a/infra/requirements.txt
+++ b/infra/requirements.txt
@@ -4,6 +4,6 @@
 # let Dependabot propose bumps that CI then re-verifies.
 # NOTE: cdk-nag stays on 2.x — 3.0 removed the NagSuppressions API this stack
 # uses (see stacks/platform/nag_suppressions.py).
-aws-cdk-lib==2.261.0
+aws-cdk-lib==2.265.0
 constructs==10.6.0
 cdk-nag==2.37.55