diff --git a/build.xml b/build.xml
index 8d86f920e2..fc24a3ddf4 100644
--- a/build.xml
+++ b/build.xml
@@ -295,7 +295,7 @@ under the License.
     <dependency prefix="main.antlauncher" artifact="org.apache.ant:ant-launcher:1.10.14" usage="excelant"/>
 
     <!-- xml signature libs - not part of the distribution -->
-    <dependency prefix="dsig.xmlsec" artifact="org.apache.santuario:xmlsec:3.0.3" usage="ooxml-provided"/>
+    <dependency prefix="dsig.xmlsec" artifact="org.apache.santuario:xmlsec:4.0.1" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-prov" artifact="org.bouncycastle:bcprov-jdk18on:1.77" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-pkix" artifact="org.bouncycastle:bcpkix-jdk18on:1.77" usage="ooxml-provided"/>
     <dependency prefix="dsig.bouncycastle-util" artifact="org.bouncycastle:bcutil-jdk18on:1.77" usage="ooxml-provided"/>
diff --git a/poi-ooxml/build.gradle b/poi-ooxml/build.gradle
index 0211ccdf22..34679dfb1f 100644
--- a/poi-ooxml/build.gradle
+++ b/poi-ooxml/build.gradle
@@ -66,11 +66,11 @@ dependencies {
     api "org.apache.logging.log4j:log4j-api:${log4jVersion}"
     api 'org.apache.commons:commons-collections4:4.4'
 
-    signingImplementation 'org.apache.santuario:xmlsec:3.0.3'
+    signingImplementation 'org.apache.santuario:xmlsec:4.0.1'
     signingImplementation "org.bouncycastle:bcpkix-jdk18on:${bouncyCastleVersion}"
     signingImplementation "org.bouncycastle:bcutil-jdk18on:${bouncyCastleVersion}"
 
-    rendersignImplementation 'org.apache.santuario:xmlsec:3.0.3'
+    rendersignImplementation 'org.apache.santuario:xmlsec:4.0.1'
     rendersignImplementation "org.bouncycastle:bcpkix-jdk18on:${bouncyCastleVersion}"
     rendersignImplementation "org.bouncycastle:bcutil-jdk18on:${bouncyCastleVersion}"