diff --git a/MODULE.bazel b/MODULE.bazel
index 9b10b1e3c36..82ee55c095c 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -23,20 +23,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.truth:truth:1.4.5",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.132.Final",
-    "io.netty:netty-codec-http2:4.1.132.Final",
-    "io.netty:netty-codec-http:4.1.132.Final",
-    "io.netty:netty-codec-socks:4.1.132.Final",
-    "io.netty:netty-codec:4.1.132.Final",
-    "io.netty:netty-common:4.1.132.Final",
-    "io.netty:netty-handler-proxy:4.1.132.Final",
-    "io.netty:netty-handler:4.1.132.Final",
-    "io.netty:netty-resolver:4.1.132.Final",
+    "io.netty:netty-buffer:4.1.133.Final",
+    "io.netty:netty-codec-http2:4.1.133.Final",
+    "io.netty:netty-codec-http:4.1.133.Final",
+    "io.netty:netty-codec-socks:4.1.133.Final",
+    "io.netty:netty-codec:4.1.133.Final",
+    "io.netty:netty-common:4.1.133.Final",
+    "io.netty:netty-handler-proxy:4.1.133.Final",
+    "io.netty:netty-handler:4.1.133.Final",
+    "io.netty:netty-resolver:4.1.133.Final",
     "io.netty:netty-tcnative-boringssl-static:2.0.75.Final",
     "io.netty:netty-tcnative-classes:2.0.75.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.132.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.132.Final",
-    "io.netty:netty-transport:4.1.132.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.133.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.133.Final",
+    "io.netty:netty-transport:4.1.133.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",
diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 705026a3fe3..a951303d209 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -101,17 +101,17 @@ mockito-android = "org.mockito:mockito-android:4.4.0"
 mockito-core = "org.mockito:mockito-core:4.4.0"
 # Need to decide when we require users to absorb the breaking changes in 4.2
 # checkForUpdates: netty-codec-http2:4.1.+
-netty-codec-http2 = "io.netty:netty-codec-http2:4.1.132.Final"
+netty-codec-http2 = "io.netty:netty-codec-http2:4.1.133.Final"
 # checkForUpdates: netty-handler-proxy:4.1.+
-netty-handler-proxy = "io.netty:netty-handler-proxy:4.1.132.Final"
+netty-handler-proxy = "io.netty:netty-handler-proxy:4.1.133.Final"
 # Keep the following references of tcnative version in sync whenever it's updated:
 #   SECURITY.md
 netty-tcnative = "io.netty:netty-tcnative-boringssl-static:2.0.75.Final"
 netty-tcnative-classes = "io.netty:netty-tcnative-classes:2.0.75.Final"
 # checkForUpdates: netty-transport-epoll:4.1.+
-netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.1.132.Final"
+netty-transport-epoll = "io.netty:netty-transport-native-epoll:4.1.133.Final"
 # checkForUpdates: netty-unix-common:4.1.+
-netty-unix-common = "io.netty:netty-transport-native-unix-common:4.1.132.Final"
+netty-unix-common = "io.netty:netty-transport-native-unix-common:4.1.133.Final"
 okhttp = "com.squareup.okhttp:okhttp:2.7.5"
 # okio 3.5+ uses Kotlin 1.9+ which requires Android Gradle Plugin 9+
 # checkForUpdates: okio:3.4.+
diff --git a/repositories.bzl b/repositories.bzl
index 0a09cece070..889d15f71e2 100644
--- a/repositories.bzl
+++ b/repositories.bzl
@@ -27,20 +27,20 @@ IO_GRPC_GRPC_JAVA_ARTIFACTS = [
     "com.google.truth:truth:1.4.5",
     "com.squareup.okhttp:okhttp:2.7.5",
     "com.squareup.okio:okio:2.10.0",  # 3.0+ needs swapping to -jvm; need work to avoid flag-day
-    "io.netty:netty-buffer:4.1.132.Final",
-    "io.netty:netty-codec-http2:4.1.132.Final",
-    "io.netty:netty-codec-http:4.1.132.Final",
-    "io.netty:netty-codec-socks:4.1.132.Final",
-    "io.netty:netty-codec:4.1.132.Final",
-    "io.netty:netty-common:4.1.132.Final",
-    "io.netty:netty-handler-proxy:4.1.132.Final",
-    "io.netty:netty-handler:4.1.132.Final",
-    "io.netty:netty-resolver:4.1.132.Final",
+    "io.netty:netty-buffer:4.1.133.Final",
+    "io.netty:netty-codec-http2:4.1.133.Final",
+    "io.netty:netty-codec-http:4.1.133.Final",
+    "io.netty:netty-codec-socks:4.1.133.Final",
+    "io.netty:netty-codec:4.1.133.Final",
+    "io.netty:netty-common:4.1.133.Final",
+    "io.netty:netty-handler-proxy:4.1.133.Final",
+    "io.netty:netty-handler:4.1.133.Final",
+    "io.netty:netty-resolver:4.1.133.Final",
     "io.netty:netty-tcnative-boringssl-static:2.0.75.Final",
     "io.netty:netty-tcnative-classes:2.0.75.Final",
-    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.132.Final",
-    "io.netty:netty-transport-native-unix-common:4.1.132.Final",
-    "io.netty:netty-transport:4.1.132.Final",
+    "io.netty:netty-transport-native-epoll:jar:linux-x86_64:4.1.133.Final",
+    "io.netty:netty-transport-native-unix-common:4.1.133.Final",
+    "io.netty:netty-transport:4.1.133.Final",
     "io.opencensus:opencensus-api:0.31.0",
     "io.opencensus:opencensus-contrib-grpc-metrics:0.31.0",
     "io.perfmark:perfmark-api:0.27.0",